CVE-2026-111707
99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 16, 2026
- Updated
- Oct 16, 2026
- Reserved
- Oct 16, 2026
Description
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
99AIvastxie |
|
References
- https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idorthird-party-advisory
- https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts#L463-L475technical-description
- https://github.com/vastxie/99AI/blob/v4.3.0/service/src/common/auth/jwtAuth.guard.tstechnical-description
- https://github.com/vastxie/99AIproduct
- VulnCheck Advisory: 99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.