Is CVE-2026-85669 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85669?

CVE-2026-85669 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-85669

Description

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending changes.