The vulnerability resides in the /memory/collections/{collection_id}/points endpoint of Cheshire Cat AI’s core application. Per‑user filtering is omitted when retrieving episodic memory points, allowing an authenticated user who holds a MEMORY:READ privilege to iteratively fetch every conversation message stored for all users. Consistent application of this endpoint therefore exposes private user data, constituting a confidentiality breach. The weakness is classified as CWE‑863, indicating missing authorization control over a privileged operation.

Cheshire Cat AI core (e.g., the repository identified at https://github.com/cheshire-cat-ai/core). While the exact version range is not enumerated in the CNA data, external links reference the 1.9.2 source tree, implying that at least this release is vulnerable. Administrators of any deployments using Cheshire Cat AI core should verify whether their installation corresponds to or is older than that commit.

The CVSS score of 7.1 indicates high severity, and the EPSS score is not available which prevents an immediate statistical estimate of exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly available exploits are confirmed, but the endpoint requires only internal authentication and a common read‑level permission. Attackers who compromise or are granted a user account can exercise this endpoint, paginate through the points via the offset cursor, and recover the entire conversation history of all users. The exploit path is straightforward for any authenticated user with the relevant permission, making the risk of unauthorized data exposure tangible for organizations that have not yet applied a fix.