Live › vulnerability › CVE-2026-111706
Go to dashboard99AI through 4.3.0 (vastxie/99AI, NestJS backend) exposes POST /api/chatLog/exportExcel with no auth guard, and the app has no global guard. Anyone who can reach the backend can download an xlsx of all users' usernames, emails, prompts and AI answers, paged with page/size, or narrowed to one victim with an email field. The same module also has a related IDOR: GET /api/chatLog/querySingleChat reads any message by id, and the JWT guard mints a visitor token from a fingerprint header, so no account is needed. The second issue is from the reporter's writeup and is not part of this CVE's description. No fixed release exists yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| 99AI | github | <= 4.3.0 | – |
Content-Type: application/json -d {"page":1,"size":1} -o chat.xlsx4.3.0 and that chatLog.controller.ts has no @UseGuards on exportExcelEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.
This page as .md · .json · in your agent: get_signal("CVE-2026-111706")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.