{"id":"CVE-2026-111706","kind":"vulnerability","aliases":["CVE-2026-111706"],"related":[],"title":"99AI: unauthenticated export of all users' chat logs","description":"99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.","summary":"99AI through 4.3.0 (vastxie/99AI, NestJS backend) exposes POST /api/chatLog/exportExcel with no auth guard, and the app has no global guard. Anyone who can reach the backend can download an xlsx of all users' usernames, emails, prompts and AI answers, paged with page/size, or narrowed to one victim with an email field. The same module also has a related IDOR: GET /api/chatLog/querySingleChat reads any message by id, and the JWT guard mints a visitor token from a fingerprint header, so no account is needed. The second issue is from the reporter's writeup and is not part of this CVE's description. No fixed release exists yet.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"99AI","fixed":[],"affected":"<= 4.3.0","ecosystem":"github"}],"ecosystems":[],"tags":["99ai","ai-tooling","nestjs","self-hosted"],"not_affected_if":["blocked-at-proxy","managed-hosting","not-internet-exposed","version-above-4.3.0"],"how_to_check":"Run: curl -s -X POST https://<your-host>/api/chatLog/exportExcel -H 'Content-Type: application/json' -d '{\"page\":1,\"size\":1}' -o chat.xlsx. If you get an xlsx file instead of 401/403, you are exposed. Also check the version is <= 4.3.0 and that chatLog.controller.ts has no @UseGuards on exportExcel.","fix":"No patched release as of 2026-10-23. Workaround: block POST /api/chatLog/exportExcel at the reverse proxy or WAF, or add @UseGuards(AdminAuthGuard) above exportExcel in service/src/modules/chatLog/chatLog.controller.ts and rebuild. For querySingleChat, scope the lookup by req.user.id. Treat past chat logs and user emails as possibly exposed.","status":"open","published_at":"2026-10-16T18:17:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:37:42+00:00","updated_at":"2026-10-23T22:38:35+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:37:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"99AI: unauthenticated export of all users' chat logs","impact":"high","summary":"99AI through 4.3.0 has a POST /api/chatLog/exportExcel route with no authentication check. An unauthenticated attacker can download an xlsx file containing every user's username, email, prompts and AI answers.","category":"ai-tooling","who_cares":["99ai","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker downloads all users' emails, usernames and chat prompts without logging in","analyst_note":"Check the NVD entry and the 99AI project for a patched release after 4.3.0 and confirm whether the route is reachable on default installs.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","version-above-4.3.0"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000463,"input_tokens":2930,"output_tokens":339,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the 99AI project for a patched release after 4.3.0 and confirm whether the route is reachable on default installs.","search":"'-111706':11A,14A '-2026':10A,13A '/api/chatlog/exportexcel':32B,141C '/api/chatlog/querysinglechat':84B '4.3.0':26B,132C '99ai':1A,15A,16B,24B,130C 'account':104B 'ai':18B,61B,174C 'ai-tool':17B 'allow':144C 'also':78B 'answer':62B,175C 'anyon':44B 'app':39B 'attack':146C,153C 'auth':35B 'authent':136C 'backend':29B,49B 'chat':7A,151C 'contain':133C,169C 'control':158C 'cve':9A,12A,122B 'descript':124B 'download':51B,166C 'email':58B,73B,163C,171C 'exist':128B 'export':3A,148C 'expos':30B 'field':74B,164C 'file':168C 'fingerprint':100B 'fix':126B 'get':83B 'global':42B 'guard':36B,43B,93B 'header':101B 'host':23B 'id':89B 'idor':82B 'issu':109B 'jwt':92B 'log':8A,152C 'messag':87B 'mint':94B 'miss':135C 'modul':77B 'narrow':67B 'need':106B 'nestj':20B,28B 'one':69B 'option':162C 'page':63B,159C 'page/size':65B 'part':119B 'post':31B,140C 'prompt':59B,172C 'reach':47B 'read':85B 'relat':81B 'releas':127B 'report':113B 'request':156C 'rout':142C 'second':108B 'self':22B 'self-host':21B 'send':155C 'size':160C 'token':97B 'tool':19B 'unauthent':2A,145C 'user':6A,56B,150C 'usernam':57B,170C 'vastxie/99ai':27B 'victim':70B 'visitor':96B 'vulner':137C 'writeup':115B 'xlsx':53B,167C 'yet':129B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111706","severity":null,"published_at":"2026-10-16T18:17:54+00:00","modified_at":"2026-10-16T22:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111706:266","url":null,"severity":null,"published_at":"2026-10-23T22:38:35+00:00","modified_at":"2026-10-23T22:38:35+00:00","first_seen_at":"2026-10-23T22:38:35+00:00","fetched_at":"2026-10-23T22:38:35+00:00","note":"Confirmed by reporter's source review (hackmd) and the v4.3.0 and main controller source: exportExcel has no guard, so it is anonymous. No patched release exists; latest stable is v4.3.0 and main is still unguarded as of 2026-10-23. No PoC executed and no exploitation reported; X has no chatter."}],"documents":[{"id":1543,"url":"https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor","title":"99AI chat-log module: unauthenticated bulk conversation export and cross-user IDOR (reporter writeup)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1545,"url":"https://github.com/vastxie/99AI/blob/main/service/src/modules/chatLog/chatLog.controller.ts","title":"99AI main: chatLog.controller.ts, exportExcel still has no guard","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1547,"url":"https://github.com/vastxie/99AI/releases","title":"99AI releases (latest stable v4.3.0)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1551,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111706","title":"CVE Record CVE-2026-111706","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}