CVE-2026-75480

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/volcengine/OpenViking
https://github.com/volcengine/OpenViking/blob/main/openviking/storage/viking_vector_index_backend.py
https://github.com/volcengine/OpenViking/issues/3724
https://www.vulncheck.com/advisories/openviking-debug-vector-endpoints-multi-tenant-data-exposure

Configurations

No configuration.

History

23 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Los puntos finales de depuración de desplazamiento de vector y conteo de OpenViking aplican solo un alcance a nivel de cuenta sin controles de acceso a nivel de usuario, permitiendo a los usuarios autenticados leer todos los registros de co-inquilinos. Los atacantes pueden consultar estos puntos finales para recuperar memorias privadas, recursos, habilidades y material secreto pertenecientes a otros usuarios en la misma cuenta sin privilegios administrativos.

Information

Published : 2026-08-17 21:16

Updated : 2026-10-23 16:10

NVD link : CVE-2026-75480

Mitre link : CVE-2026-75480

CVE.ORG link : CVE-2026-75480

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-75480", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75480", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T15:16:49.778277Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/volcengine/OpenViking", "vendor": "volcengine", "product": "OpenViking", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.4.14"}], "packageURL": "pkg:pypi/openviking", "defaultStatus": "unaffected"}]}], "published": "2026-08-17T21:16:50.477", "references": [{"url": "https://github.com/volcengine/OpenViking", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/volcengine/OpenViking/blob/main/openviking/storage/viking_vector_index_backend.py", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/volcengine/OpenViking/issues/3724", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/openviking-debug-vector-endpoints-multi-tenant-data-exposure", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges."}, {"lang": "es", "value": "Los puntos finales de depuraci\u00f3n de desplazamiento de vector y conteo de OpenViking aplican solo un alcance a nivel de cuenta sin controles de acceso a nivel de usuario, permitiendo a los usuarios autenticados leer todos los registros de co-inquilinos. Los atacantes pueden consultar estos puntos finales para recuperar memorias privadas, recursos, habilidades y material secreto pertenecientes a otros usuarios en la misma cuenta sin privilegios administrativos."}], "lastModified": "2026-10-23T16:10:00.313", "sourceIdentifier": "disclosure@vulncheck.com"}