IDOR - Cross-User Chat Feedback Manipulation in AnythingLLM

[!NOTE]
Maintainer able to reproduce.
This action however has zero impact on any systems as the rating system simply is an indicator for admins who export their chats for RL/Fine-Tuning to quickly prune non-rated answers (if they use the feedback signal at all).

Feedback ratings are not used in any way to prioritize inference, ranking of chats or any other feature.
The chat owner can also overwrite any tampered rating at any time.

Summary

The chat feedback endpoint does not verify that the authenticated user owns the chat being rated. The ownership check filters only by workspaceId, not by user_id. Any authenticated user with access to a workspace can overwrite the feedback score
of any other user's chat in that workspace by supplying an arbitrary chatId. Because chat IDs are sequential integers, they are trivially enumerable.

Vulnerable Code

server/endpoints/workspaces.js

app.post(
  "/workspace/:slug/chat-feedback/:chatId",
  [validatedRequest, flexUserRoleValid([ROLES.all]), validWorkspaceSlug],
  async (request, response) => {
    try {
      const { chatId } = request.params;
      const { feedback = null } = reqBody(request);

      const existingChat = await WorkspaceChats.get({
        id: Number(chatId),
        workspaceId: response.locals.workspace.id,
        // user_id is not included - no ownership check
      });

      if (!existingChat) {
        response.status(404).end();
        return;
      }

      cons…