PT-2026-3503 · Crawlchat+1 · Crawlchat+1

Egelhaus · Published 2026-01-19 · Updated 2026-02-05 · CVE-2026-23875

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CrawlChat versions prior to 0.0.8

Description CrawlChat is a platform that converts technical documentation into intelligent chatbots. Before version 0.0.8, a missing permission check in the Discord bot component allowed users without administrative privileges to add malicious content to the knowledge base. Specifically, the absence of a check for permissions like MANAGE SERVER or MANAGE MESSAGES allowed regular users to add information to the knowledge base using the jigsaw emoji reaction. This could be exploited to manipulate the bot's responses, potentially redirecting users to malicious sites or sending information to unauthorized individuals. The affected functionality involves adding information to the collection's knowledge base.

Recommendations Update CrawlChat to version 0.0.8 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-23875

GHSA-F484-62P4-6W4P

Affected Products

Crawlchat

Discord

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23875.json · Exploit
• https://github.com/crawlchat/crawlchat/commit/f90ebb93c6a830f6cf609d683f6425af8434573a · Patch
• https://github.com/crawlchat/crawlchat/security/advisories/GHSA-f484-62p4-6w4p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23875 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23875 · Vendor Advisory
• https://github.com/crawlchat/crawlchat/releases/tag/v0.0.8 · Note
• https://twitter.com/VulmonFeeds/status/2013388305220383056 · Twitter Post
• https://t.me/cveNotify/151038 · Telegram Post
• https://twitter.com/CVEnew/status/2013359960051130544 · Twitter Post