---
id: "CVE-2026-111707"
kind: "vulnerability"
aliases: ["CVE-2026-111707"]
title: "99AI: unauthenticated users can read other users' chat messages"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["99ai", "ai-tooling", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-16T18:17:54+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:42:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111707", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# 99AI: unauthenticated users can read other users' chat messages

99AI through 4.3.0 has an insecure direct object reference in querySingleChat, which lacks an owner check. An unauthenticated attacker can send a fingerprint header to get a visitor JWT, then iterate sequential chatId values to read other users' message content and task data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111707

## From the sources

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_