Chatbot UI contains an authorization bypass in its retrieval endpoint that allows an authenticated attacker to supply arbitrary file UUIDs and retrieve the content of private files belonging to other users. The endpoint uses a service‑role Supabase client that circumvents row‑level security and does not verify file ownership, leading to disclosure of confidential information. The flaw is classified as CWE‑639.

The vulnerability affects the open‑source project provided by mckaywrigley:chatbot‑ui. No specific version range is disclosed, but all instances that use the exposed retrieval endpoint are susceptible.

With a CVSS score of 7.1 the vulnerability represents a moderate‑high risk to confidentiality for authenticated users. EPSS is not available and it is not listed in the CISA KEV catalog, yet the existence of an authenticated bypass makes exploitation plausible on any deployed instance that uses the unpatched code. Attackers can construct crafted POST requests to the retrieval API and leverage the privileged Supabase client to read file chunks belonging to other users.