CVE-2026-13483: DocsGPT Credential Tampering Vulnerability (CWE-345)

Technical summary

CVE-2026-13483 is a cryptographic authentication bypass affecting the `encrypt_credentials()` function in `application/security/encryption.py`. The vulnerability stems from insufficient verification of data authenticity (CWE-345), meaning encrypted credentials can be modified without the system detecting tampering. The attack vector is network-based and requires the attacker to be authenticated (PR:L). The CVSS 3.1 score of 3.1 reflects low severity with integrity impact but no confidentiality or availability compromise. Attack complexity is rated high, indicating non-trivial exploitation requirements despite public disclosure of proof-of-concept code.

Business impact

Organizations running DocsGPT face a limited but real insider threat: authenticated users could alter stored credentials (such as API keys or service account passwords) to escalate privileges or maintain persistent access without triggering integrity alarms. This is primarily a risk when DocsGPT is deployed in multi-user environments or where administrative controls are weak. The impact is constrained by the requirement for authenticated access and the absence of data exfiltration or service disruption. For teams using DocsGPT in development or low-security settings, this is a secondary concern; for production deployments managing sensitive integrations, credential tampering poses governance and audit-trail risks.

Affected systems

arc53 DocsGPT versions 0.18.0 and earlier are affected. Organizations should verify their deployment version immediately. Pinpointing the earliest vulnerable version requires review of the project's commit history; if your instance is 0.18.0 or older, assume it is vulnerable unless patched separately.

Exploitability

Exploitation is ranked as difficult and requires authentication. An attacker must first gain login credentials to the DocsGPT instance, then possess sufficient cryptographic knowledge to manipulate the encrypted credential storage without correct authentication tokens. A public proof-of-concept exists, lowering the barrier to exploitation for determined actors, but does not constitute a trivial one-click attack. The high attack complexity suggests standard security configurations (such as TLS, access controls, and strong authentication) provide meaningful defensive value.

Remediation

Apply the patched version when the pending pull request is merged and released. Until then, mitigate risk by: restricting DocsGPT access to highly trusted users only; implementing network-level access controls to limit who can reach the application; logging and monitoring credential storage modifications; and rotating any credentials known to have been stored in affected versions. If credentials cannot be rotated, consider isolating the affected DocsGPT instance until a patch is available.

Patch guidance

Monitor the arc53 DocsGPT project repository for release of the fix. The pull request addressing this vulnerability is under review; when merged and released, upgrade to the patched version immediately. Verify the fix in release notes and commit history to confirm the `encrypt_credentials()` function has been updated with proper authentication verification. Test in a non-production environment before deploying to production.

Detection guidance

Review audit logs for unauthorized modifications to credential storage or unexpected credential updates that do not correlate with user actions. Inspect the encrypted credential storage files for signs of tampering (e.g., changed modification times without corresponding API calls). Deployment-level monitoring should flag any direct filesystem modifications to the credentials store. Network-based detection is limited because the attack leverages legitimate authentication; focus on behavioral anomalies (e.g., sudden use of previously stored credentials with different access patterns).

Why prioritize this

This is a low-priority vulnerability for most organizations but warrants near-term attention in multi-user or regulated environments. The requirement for authentication, high attack complexity, and absence of remote unauthenticated exploitation keep it below critical thresholds. However, credential tampering in audit-sensitive contexts can have compliance implications. Prioritize patching if DocsGPT manages credentials for production systems or if your user base includes untrusted accounts.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects the constraint of authenticated-only access (PR:L), high attack complexity (AC:H), and integrity-only impact (I:L) with no confidentiality or availability loss (C:N, A:N). The public proof-of-concept raises exploitability but does not change the technical difficulty or required preconditions. The score appropriately reflects that this is a concern for trusted-user insider scenarios rather than external or mass-exploitation risk.

Frequently asked questions