Live › vulnerability › CVE-2026-106677
Go to dashboardThe ChatServiceImpl in Homestay3 homestay-backend 0.0.1-SNAPSHOT does not check that the caller is a participant of a conversation. An authenticated user can view conversations, read messages, send messages and mark messages as read for any conversation id they know.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
Teams running the Homestay3 homestay-backend 0.0.1-SNAPSHOT build with its chat feature enabled and user accounts exposed to other users. Deployments without a chat feature or with no multi-user accounts are less exposed. unknown for any patched release.
No product ranges from the sources yet.
ChatServiceImpl in the homestay-backend source and confirm whether conversation methods verify the caller is a participant before returning data.0.0.1-SNAPSHOT is in use in your build.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.
This page as .md · .json · in your agent: get_signal("CVE-2026-106677")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.