{"id":"CVE-2026-111707","kind":"vulnerability","aliases":["CVE-2026-111707"],"related":[],"title":"99AI: unauthenticated users can read other users' chat messages","description":"99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.","summary":"99AI through 4.3.0 has an insecure direct object reference in querySingleChat, which lacks an owner check. An unauthenticated attacker can send a fingerprint header to get a visitor JWT, then iterate sequential chatId values to read other users' message content and task data.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["99ai","ai-tooling","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:42:20+00:00","updated_at":"2026-10-25T03:42:20+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:42:20Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"99AI: unauthenticated users can read other users' chat messages","impact":"medium","summary":"99AI through 4.3.0 has an insecure direct object reference in querySingleChat, which lacks an owner check. An unauthenticated attacker can send a fingerprint header to get a visitor JWT, then iterate sequential chatId values to read other users' message content and task data.","category":"ai-tooling","nicknames":[],"who_cares":["99ai","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads other users' chat messages and task data","analyst_note":"Check the NVD entry and the 99AI project for a patched release and for whether the chat endpoint is reachable by default.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Deployments of 99AI up to and including 4.3.0 that expose the chat interface to visitors. The sources do not say which configurations are affected beyond that, so unknown beyond the version range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000538,"input_tokens":3333,"output_tokens":410,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111707':12A,15A '-2026':11A,14A '4.3.0':25B,68C '99ai':1A,16B,23B,66C 'ai':18B 'ai-tool':17B 'allow':77C 'attack':41B,79C,92C 'chat':8A,84C 'chatid':55B,106C 'check':38B,91C 'contain':69C 'content':62B,113C 'cve':10A,13A 'data':65B,116C 'direct':29B,72C 'fingerprint':45B,96C 'get':48B 'header':46B,97C 'host':22B 'insecur':28B,71C 'iter':53B,104C 'jwt':51B,102C 'lack':35B,88C 'messag':9A,61B,85C,112C 'object':30B,73C 'obtain':99C 'owner':37B,90C 'querysinglechat':33B,87C 'read':5A,58B,81C 'refer':31B,74C 'retriev':109C 'self':21B 'self-host':20B 'send':43B,94C 'sequenti':54B,105C 'task':64B,115C 'tool':19B 'unauthent':2A,40B,78C 'user':3A,7A,60B,83C,111C 'valu':56B,107C 'visitor':50B,101C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Deployments of 99AI up to and including 4.3.0 that expose the chat interface to visitors. The sources do not say which configurations are affected beyond that, so unknown beyond the version range.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111707","severity":null,"published_at":"2026-10-16T18:17:54+00:00","modified_at":"2026-10-16T19:17:05+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}