{"id":"CVE-2026-6588","state":"PUBLISHED","title":"serge-chat serge Model API Endpoint model.py delete_model missing authentication","description":"A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/routers/model.py of the component Model API Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-04-20T00:15:12.174Z","updatedAt":"2026-04-20T16:15:13.000Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["serge-chat serge"],"affected":[{"vendor":"serge-chat","product":"serge","versions":[{"version":"1.4TB","status":"affected"}],"modules":["Model API Endpoint"]}],"references":["https://vuldb.com/vuln/358223","https://vuldb.com/vuln/358223/cti","https://vuldb.com/submit/791089","https://gist.github.com/YLChen-007/5fbc93a21f9928e91a72ab0d72fb1e88"],"weaknesses":["CWE-306","CWE-287"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/6xxx/CVE-2026-6588.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-6588","state":"PUBLISHED","datePublished":"2026-04-20T00:15:12.174Z","dateUpdated":"2026-04-20T16:15:13.000Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-04-19T09:03:50.771Z"},"containers":{"cna":{"title":"serge-chat serge Model API Endpoint model.py delete_model missing authentication","descriptions":[{"lang":"en","value":"A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/routers/model.py of the component Model API Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"serge-chat","product":"serge","versions":[{"version":"1.4TB","status":"affected"}],"modules":["Model API Endpoint"]}],"references":[{"url":"https://vuldb.com/vuln/358223","name":"VDB-358223 | serge-chat serge Model API Endpoint model.py delete_model missing authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/358223/cti","name":"VDB-358223 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/791089","name":"Submit #791089 | serge-chat serge <= 3cb250c Missing Authentication for Critical Function (CWE-306)","tags":["third-party-advisory"]},{"url":"https://gist.github.com/YLChen-007/5fbc93a21f9928e91a72ab0d72fb1e88","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.5,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.4,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","type":"CWE","lang":"en","description":"Missing Authentication"}]},{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"Improper Authentication"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-04-20T00:15:12.174Z"},"timeline":[{"time":"2026-04-19T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-04-19T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-04-19T11:08:56.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Eric-a (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-20T16:14:56.878403Z","id":"CVE-2026-6588","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-20T16:15:13.000Z"}}]}}}