Security readout for executives and security teams
Plain-English summary
CVE-2026-23875 lets ordinary Discord guild users add content to CrawlChat’s knowledge base when only admins or moderators should be able to. This can poison chatbot answers across integrations, potentially redirecting users to malicious sites or misleading them. The vendor says version 0.0.8 patches the issue.
Executive priority
Treat as a near-term integrity risk for public or semi-public Discord communities. Prioritize upgrade where CrawlChat answers influence customers, developers, or support workflows, because poisoned AI responses can damage trust and route users to harmful destinations.
Technical view
CrawlChat before 0.0.8 lacks an authorization check for the Discord bot’s knowledge-saving workflow, mapped to CWE-862. A low-privileged guild user can add attacker-chosen messages to the collection knowledge base. CVSS v4.0 is 5.7, driven by high integrity impact and low attack complexity.
Likely exposure
Exposure is limited to organizations using CrawlChat versions before 0.0.8 with the Discord bot enabled in guilds where untrusted or ordinary users can interact with saved message workflows.
Exploitation context
The source bundle does not indicate CISA KEV listing or active exploitation. The advisory describes practical abuse: poisoning commonly asked knowledge content so bot responses misdirect users or leak information to an attacker-controlled destination.
Researcher notes
Evidence comes from the CVE record and GitHub advisory. The fix is identified as version 0.0.8, with a linked commit. No public exploit details, KEV status, or broader affected product list are provided in the source bundle.
Mitigation direction
- Upgrade CrawlChat to version 0.0.8 or later.
- Review vendor advisory and release notes before deployment.
- Restrict Discord bot usage to trusted guilds until upgraded.
- Audit recent knowledge base additions for suspicious or unauthorized content.
Validation and detection
- Inventory CrawlChat deployments and confirm installed versions.
- Verify whether the Discord bot integration is enabled.
- Check whether any deployment is running below version 0.0.8.
- Review knowledge base entries added before remediation for unexpected content.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-23875 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.7MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/crawlchat/crawlchat/security/advisories/GHSA-f484-62p4-6w4pCVE reference · x_refsource_CONFIRM
- https://github.com/crawlchat/crawlchat/commit/f90ebb93c6a830f6cf609d683f6425af8434573aCVE reference · x_refsource_MISC
- https://github.com/crawlchat/crawlchat/releases/tag/v0.0.8CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.