CVE-2026-7844 Details

A missing authentication vulnerability has been identified in Langchain-Chatchat versions through 0.3.1.3. The issue resides in the Compatible File Service component, specifically within the OpenAI routes of the API server. The vulnerability allows unauthorized access to file management endpoints, including uploading, listing, reading, and deleting files. This flaw affects all users on the local network, exploiting the absence of authentication checks on critical file operations.

To address this vulnerability, it is recommended to add authentication middleware to the file service endpoints, validate file ownership to ensure users can only access their own files, and restrict CORS settings to specific trusted origins. Additionally, the documentation should advise against exposing the API port to untrusted networks.