Skip to main content

Missing Authorization

CVE-2026-46444

High
8.7/10

Summary

ALL CRUD endpoints for OpenAI Assistants Vector Store have no authentication middleware AND the route path /api/v1/openai-assistants-vector-store is NOT in WHITELIST_URLS. However, it is also NOT protected by the main auth middleware when accessed via API key -- the route requires API key auth (not whitelisted), but NO permission checks exist on any operation. The affected versions are prior to 3.1.2.

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published