CVE-2026-111630

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111630

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111630.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111630

Published

2026-10-16T17:39:04Z

Modified

2026-10-24T02:49:51Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations

Details

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call ChatAppService.GetListAsync or SendMessageAsync with a victim's ConversationId GUID to read chat messages and inject messages into that conversation.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111630.json"
}

References

Affected packages

Git / github.com/colinin/abp-next-admin

Affected ranges

Type

GIT

Repo

https://github.com/colinin/abp-next-admin

Events

Introduced

59cfbafc73e4be03a3ea5c3fc0ff525da52a11d7

Last Affected

681d9ecc13477020d03c4dd65057a4f5fe1c8f0a

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "10.2.0"
                },
                {
                    "last_affected":  "10.6.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "10.2.0"
                },
                {
                    "last_affected":  "10.6.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111630.json"