TI-2026-84364 CVE-2026-121558 · GHSA-662g-qcpv-pf65
Authorization bypass in AuditPilot RAG lets users read other projects' knowledge
Priority LOW 12
AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects' knowledge by supplying project_id.