{"id":"CVE-2026-106677","kind":"vulnerability","aliases":["CVE-2026-106677"],"related":[],"title":"Homestay3 homestay-backend: chat service lets any user read other conversations","description":"Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.","summary":"The ChatServiceImpl in Homestay3 homestay-backend 0.0.1-SNAPSHOT does not check that the caller is a participant of a conversation. An authenticated user can view conversations, read messages, send messages and mark messages as read for any conversation id they know.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["homestay-backend","homestay3","java","package","self-hosted"],"not_affected_if":["chat-feature-disabled"],"how_to_check":"- Look for `ChatServiceImpl` in the homestay-backend source and confirm whether conversation methods verify the caller is a participant before returning data.\n- Confirm the deployed version: unknown whether `0.0.1-SNAPSHOT` is in use in your build.","fix":null,"status":"open","published_at":"2026-10-26T17:17:11+00:00","first_seen_at":"2026-10-26T17:31:21+00:00","triaged_at":"2026-10-26T17:33:35+00:00","updated_at":"2026-10-26T17:33:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T17:33:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Homestay3 homestay-backend: chat service lets any user read other conversations","impact":"medium","summary":"The ChatServiceImpl in Homestay3 homestay-backend 0.0.1-SNAPSHOT does not check that the caller is a participant of a conversation. An authenticated user can view conversations, read messages, send messages and mark messages as read for any conversation id they know.","category":"package","nicknames":[],"who_cares":["homestay3","homestay-backend","java","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Other users' private chat messages are readable and messages can be sent into their conversations.","analyst_note":"Find the upstream fix or patched version for homestay-backend and confirm which endpoints are affected, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-106677.","how_to_check":"- Look for `ChatServiceImpl` in the homestay-backend source and confirm whether conversation methods verify the caller is a participant before returning data.\n- Confirm the deployed version: unknown whether `0.0.1-SNAPSHOT` is in use in your build.","needs_analyst":true,"not_affected_if":["chat-feature-disabled"],"who_is_affected":"Teams running the Homestay3 homestay-backend 0.0.1-SNAPSHOT build with its chat feature enabled and user accounts exposed to other users. Deployments without a chat feature or with no multi-user accounts are less exposed. unknown for any patched release.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3318,"output_tokens":580,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106677':15A,18A '-2026':14A,17A '0.0.1':35B,74C 'arbitrari':97C 'authent':50B,82C 'backend':4A,21B,34B,73C 'caller':42B,108C 'chat':5A 'chatserviceimpl':29B,80C 'check':39B 'contain':76C 'convers':12A,48B,54B,66B,86C,98C,111C 'cve':13A,16A 'homestay':3A,20B,33B,72C 'homestay-backend':2A,19B,32B,71C 'homestay3':1A,22B,31B,70C 'host':27B 'id':67B,99C 'idor':78C 'java':23B 'know':69B 'let':7A 'mark':60B,92C 'messag':56B,58B,61B,88C,90C,93C 'packag':24B 'particip':45B,112C 'read':10A,55B,63B,87C,95C 'self':26B 'self-host':25B 'send':57B,89C 'servic':6A,102C 'snapshot':36B,75C 'user':9A,51B,83C 'verifi':105C 'view':53B,85C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Homestay3 homestay-backend 0.0.1-SNAPSHOT build with its chat feature enabled and user accounts exposed to other users. Deployments without a chat feature or with no multi-user accounts are less exposed. unknown for any patched release.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106677","severity":null,"published_at":"2026-10-26T17:17:11+00:00","modified_at":"2026-10-26T17:17:11+00:00","first_seen_at":"2026-10-26T17:31:21+00:00","fetched_at":"2026-10-26T17:31:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}