Auth bypass in Crawlchat

CVE-2026-23875

CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing permission check for the CrawlChat's Discord bot allows non-manage guild users to put malicious content onto the collection knowledge base. Usually, admin / mods of a Discord guild use the `jigsaw` emoji to save a specific message (chain) onto the collection's knowledge base of CrawlChat. Unfortunately an permission check (for e.g. MANAGE_SERVER; MANAGE_MESSAGES etc.) was not done, allowing normal users of the guild to information to the knowledge base. With targeting specific parts that are commonly asked, users can manipulate the content given out by the bot (on all integrations), to e.g. redirect users to a malicious site, or send information to a malicious user. Version 0.0.8 patches the issue.

Vulnerability class: Broken Access Control

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.002 (12.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 12th percentile — 12.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-23875: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-23875?
CVE-2026-23875 is a medium-severity vulnerability in Crawlchat, classified under Missing Authorization. CVSS score: 5.4/10. Published 2026-01-19.
How severe is CVE-2026-23875?
Medium severity. CVSS v3 base score is 5.4 out of 10.