---
id: "CVE-2026-111706"
kind: "vulnerability"
aliases: ["CVE-2026-111706"]
title: "99AI: unauthenticated export of all users' chat logs"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "99AI", "fixed": [], "affected": "<= 4.3.0", "ecosystem": "github"}]
ecosystems: []
tags: ["99ai", "ai-tooling", "nestjs", "self-hosted"]
not_affected_if: ["blocked-at-proxy", "managed-hosting", "not-internet-exposed", "version-above-4.3.0"]
published_at: "2026-10-16T18:17:54+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T22:38:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111706", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:38:35+00:00"}]
---

# 99AI: unauthenticated export of all users' chat logs

99AI through 4.3.0 (vastxie/99AI, NestJS backend) exposes POST /api/chatLog/exportExcel with no auth guard, and the app has no global guard. Anyone who can reach the backend can download an xlsx of all users' usernames, emails, prompts and AI answers, paged with page/size, or narrowed to one victim with an email field. The same module also has a related IDOR: GET /api/chatLog/querySingleChat reads any message by id, and the JWT guard mints a visitor token from a fingerprint header, so no account is needed. The second issue is from the reporter's writeup and is not part of this CVE's description. No fixed release exists yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:99AI affected <= 4.3.0 fixed ?

## How to check

Run: curl -s -X POST https://<your-host>/api/chatLog/exportExcel -H 'Content-Type: application/json' -d '{"page":1,"size":1}' -o chat.xlsx. If you get an xlsx file instead of 401/403, you are exposed. Also check the version is <= 4.3.0 and that chatLog.controller.ts has no @UseGuards on exportExcel.

## Fix

No patched release as of 2026-10-23. Workaround: block POST /api/chatLog/exportExcel at the reverse proxy or WAF, or add @UseGuards(AdminAuthGuard) above exportExcel in service/src/modules/chatLog/chatLog.controller.ts and rebuild. For querySingleChat, scope the lookup by req.user.id. Treat past chat logs and user emails as possibly exposed.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111706
- 2026-10-23T22:38:35+00:00 analyst — Confirmed by reporter's source review (hackmd) and the v4.3.0 and main controller source: exportExcel has no guard, so it is anonymous. No patched release exists; latest stable is v4.3.0 and main is still unguarded as of 2026-10-23. No PoC executed and no exploitation reported; X has no chatter.

## Documents

- [advisory] 99AI chat-log module: unauthenticated bulk conversation export and cross-user IDOR (reporter writeup) https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor
- [advisory] CVE Record CVE-2026-111706 https://www.cve.org/CVERecord?id=CVE-2026-111706
- [describes] 99AI main: chatLog.controller.ts, exportExcel still has no guard https://github.com/vastxie/99AI/blob/main/service/src/modules/chatLog/chatLog.controller.ts
- [mentions] 99AI releases (latest stable v4.3.0) https://github.com/vastxie/99AI/releases

## From the sources

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_