Classic298 9f20687680 fix: add knowledge_id access check in search_knowledge_files (BOLA) (#25113) ...

When called without attached model knowledge and given a caller-supplied knowledge_id, search_knowledge_files passed it straight to Knowledges.search_files_by_id, which does not enforce ownership on knowledge_id. An authenticated user who happened to know a target UUID could enumerate file metadata (filename, file id, KB id, KB name, updated_at) from any knowledge base, bypassing the AccessGrants permission model.

Mirror the same admin/owner/AccessGrants check the attached-KB branch already uses, matching the sibling query_knowledge_files function.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-28 16:23:49 -05:00

..

__init__.py

…

builtin.py

fix: add knowledge_id access check in search_knowledge_files (BOLA) (#25113)

2026-05-28 16:23:49 -05:00

knowledge_fs.py

refac

2026-05-14 03:10:48 +09:00