CVE-2026-111706

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/vastxie/99AI
https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.controller.ts#L47-L52
https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts#L104-L155
https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor
https://www.vulncheck.com/advisories/99ai-through-4.3.0-unauthenticated-information-disclosure-via-chatlog-exportexcel

Configurations

No configuration.

History

16 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-16 18:17

Updated : 2026-10-16 22:17

NVD link : CVE-2026-111706

Mitre link : CVE-2026-111706

CVE.ORG link : CVE-2026-111706

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-111706", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111706", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T20:52:41.729124Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/vastxie/99AI", "vendor": "vastxie", "product": "99AI", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.3.0"}], "packageURL": "pkg:github/vastxie/99AI", "defaultStatus": "unaffected"}]}], "published": "2026-10-16T18:17:54.663", "references": [{"url": "https://github.com/vastxie/99AI", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.controller.ts#L47-L52", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts#L104-L155", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/99ai-through-4.3.0-unauthenticated-information-disclosure-via-chatlog-exportexcel", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers."}], "lastModified": "2026-10-16T22:17:22.943", "sourceIdentifier": "disclosure@vulncheck.com"}