CVE-2025-68492

Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.

An attacker creates a low-privilege account on a multi-user Chainlit deployment (e.g., an internal AI assistant or customer-facing LLM product). They observe that thread IDs in API requests to /thread/{id} are sequential, UUID-based but discoverable, or leaked via other endpoints. By iterating or guessing thread IDs with their authenticated session, they read conversation histories of other users—potentially exposing executive AI assistant sessions containing M&A context, HR queries, or embedded customer data. In a more targeted attack, the adversary obtains ownership of a specific high-value thread and injects adversarial context before the victim resumes their session, covertly manipulating the LLM's behavior through thread-context poisoning without any model access.