Cognee prior to version 1.2.0 contains an improper access control flaw (CWE‑306, CWE‑862) that permits an unauthenticated user to overwrite the global LLM provider configuration through the /api/v1/settings endpoint. The endpoint performs no administrative or superuser checks, enabling the attacker to point all LLM operations to an attacker‑controlled endpoint and exfiltrate sensitive information such as prompts, uploaded documents, extracted entities, and knowledge graph content from every user, thereby breaching confidentiality.

All installations of Cognee running a version earlier than 1.2.0 are affected; this includes both self‑hosted setups and open‑source deployments that have not yet applied the 1.2.0 release or a later patch.

The vulnerability has a CVSS score of 9.3, indicating a high level of severity, and an EPSS score of less than 1 %, reflecting a low overall exploitation probability across the general population; however, because authentication is not required beyond initial self‑registration and the flaw is trivially exploitable on any publicly reachable instance, the risk remains significant. The issue is not listed in the CISA KEV catalog. The attack vector is via the public self‑service registration flow followed by a call to /api/v1/settings, with no administrative credentials required.