CVE-2026-111706CWE-306

CVE-2026-111706

High · published October 16, 2026

CVSS v3.1

7.5

EPSS

Percentile

27.0

In the wild

Unconfirmed

What it is

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00347 · 27.0th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2026-10-16T22:17Z

References (5)

https://github.com/vastxie/99AI · [email protected]https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.controller.ts#L47-L52 · [email protected]https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts#L104-L155 · [email protected]https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor · [email protected]https://www.vulncheck.com/advisories/99ai-through-4.3.0-unauthenticated-information-disclosure-via-chatlog-exportexcel · [email protected]

EPSS history

Timeline

18 OCT 03:27Z
EPSS moved — → 0%
epss
16 OCT 17:39Z
99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
cvelistv5
16 OCT 17:39Z
99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
cvelistv5