Live › vulnerability › CVE-2026-116861
Flexible Chat versions 1.1.0 and older expose sensitive data to requests that carry no login. An attacker on the internet can fetch that data without any account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the Flexible Chat plugin at version 1.1.0 or older are exposed to unauthenticated requests. The sources do not say which data is exposed or which configuration is needed, so unknown for the rest. Sites without this plugin can skip it.
No product ranges from the sources yet.
1.1.0 or older1.1.0; the fixed version is not named in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116861")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.