PT-2026-3503 · Crawlchat+1 · Crawlchat+1

Egelhaus · Publicado 2026-01-19 · Atualizado 2026-02-05 · CVE-2026-23875

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CrawlChat versions prior to 0.0.8

Description CrawlChat is a platform that converts technical documentation into intelligent chatbots. Before version 0.0.8, a missing permission check in the Discord bot component allowed users without administrative privileges to add malicious content to the knowledge base. Specifically, the absence of a check for permissions like MANAGE SERVER or MANAGE MESSAGES allowed regular users to add information to the knowledge base using the jigsaw emoji reaction. This could be exploited to manipulate the bot's responses, potentially redirecting users to malicious sites or sending information to unauthorized individuals. The affected functionality involves adding information to the collection's knowledge base.

Recommendations Update CrawlChat to version 0.0.8 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-23875

GHSA-F484-62P4-6W4P

Produtos afetados

Crawlchat

Discord

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23875.json · Exploit
• https://github.com/crawlchat/crawlchat/commit/f90ebb93c6a830f6cf609d683f6425af8434573a · Correção
• https://github.com/crawlchat/crawlchat/security/advisories/GHSA-f484-62p4-6w4p · Aviso do Fabricante
• https://github.com/crawlchat/crawlchat/releases/tag/v0.0.8 · Nota
• https://twitter.com/VulmonFeeds/status/2013388305220383056 · Publicação no Twitter
• https://t.me/cveNotify/151038 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-23875 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-23875 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2013359960051130544 · Publicação no Twitter