AIKIDO-2026-742388

chat is vulnerable to Improper Authorization

Improper Authorization Pre-CVE Published Aug 12, 2026

Medium Risk

This Affects:

chat

4.29.0 - 4.36.0

Fixed in 4.37.0

Are you affected? Scan for Free

TL;DR

The chat/ai read tools produced by createChatTools let an AI agent call read operations across every conversation the bot can access. In the affected range those reads are effectively unscoped: versions 4.29.0-4.35.0 apply no read scoping at all, and 4.36.0 added channel-level scoping that still fails open when an agent runs outside a message handler with no resolvable scope and offers no thread-level confinement. Untrusted message content can steer such an agent into reading messages from channels or threads it is not handling, disclosing data from other conversations. The fix enforces per-conversation read scoping, rejects reads that resolve to a different channel, and adds a strict thread-confinement mode.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you expose the Chat SDK AI tools (createChatTools) to an agent that processes untrusted message content without an explicit read scope.