CVE-2026-5000 Details

A critical vulnerability exists in PromtEngineer localGPT versions through commit 4d41c7d, specifically within the API endpoint's LocalGPTHandler function in backend/server.py. The vulnerability arises from a complete lack of authentication and authorization, allowing any unauthenticated user to create, read, modify, and delete sessions and messages. This oversight enables access to sensitive conversation data, including database credentials, API keys, customer information, and proprietary business details. The vulnerability impacts all API endpoints, representing a significant security flaw that exposes all stored data.

To address this vulnerability, implement a robust authentication mechanism, such as JWT-based authentication, and establish authorization checks to ensure users can only access their own sessions. Additionally, update the database schema to include user ownership details and implement user registration and login functionalities. It's also crucial to fix the CORS configuration to prevent unauthorized access.