{"id":"CVE-2026-111707","summary":"99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure","details":"99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.","modified":"2026-10-17T02:48:43.364702907Z","published":"2026-10-16T17:39:58.546Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111707.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111707.json"},{"type":"PACKAGE","url":"https://github.com/vastxie/99AI"},{"type":"ARTICLE","url":"https://github.com/vastxie/99AI/blob/v4.3.0/service/src/common/auth/jwtAuth.guard.ts"},{"type":"ARTICLE","url":"https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts#L463-L475"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111707"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/99ai-through-4.3.0-idor-via-api-chatlog-querysinglechat-chat-message-disclosure"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vastxie/99ai","events":[{"introduced":"0"},{"last_affected":"cbebbfbd823c428f6aaae72d2f8e71cb785ef970"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"4.3.0"}]}}],"versions":["v4.3.0","v4.1.0","v4.0.0","v3.7.0","v3.5.0","v3.3.0","v3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111707.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}