Live › vulnerability › CVE-2026-116017
Go to dashboardXiaozhi-esp32-server before 0.9.8 has an insecure direct object reference in the manager-api DeviceController.getAddressBook handler. A logged-in user can request another user's device MAC address and read that device's contacts, aliases, call permissions and owner user IDs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
Teams self-hosting Xiaozhi-esp32-server with open or self-service user registration, where users own ESP32 devices. Deployments with only trusted, administrator-created accounts face much less exposure. unknown for any other deployment details.
No product ranges from the sources yet.
0.9.8 is in scope./device/address-book/{macAddress} is reachable by ordinary registered accounts.0.9.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.
This page as .md · .json · in your agent: get_signal("CVE-2026-116017")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.