CVE-2026-85669

EUVD-2026-71125
potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending changes.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/potpie-ai/potpie
https://github.com/potpie-ai/potpie/blob/v2.0.0/legacy/app/modules/conversations/conversations_router.py
https://github.com/potpie-ai/potpie/issues/870
https://www.vulncheck.com/advisories/potpie-through-2.0.0-missing-ownership-check-via-code-changes-sync