---
id: "CVE-2026-106677"
kind: "vulnerability"
aliases: ["CVE-2026-106677"]
title: "Homestay3 homestay-backend: chat service lets any user read other conversations"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["homestay-backend", "homestay3", "java", "package", "self-hosted"]
not_affected_if: ["chat-feature-disabled"]
published_at: "2026-10-26T17:17:11+00:00"
first_seen_at: "2026-10-26T17:31:21+00:00"
updated_at: "2026-10-26T17:33:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106677", "first_seen_at": "2026-10-26T17:31:21+00:00"}]
---

# Homestay3 homestay-backend: chat service lets any user read other conversations

The ChatServiceImpl in Homestay3 homestay-backend 0.0.1-SNAPSHOT does not check that the caller is a participant of a conversation. An authenticated user can view conversations, read messages, send messages and mark messages as read for any conversation id they know.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `ChatServiceImpl` in the homestay-backend source and confirm whether conversation methods verify the caller is a participant before returning data.
- Confirm the deployed version: unknown whether `0.0.1-SNAPSHOT` is in use in your build.

## Timeline

- 2026-10-26T17:31:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106677

## From the sources

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_