CVE-2026-111706

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111706

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111706.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111706

Published

2026-10-16T17:39:57Z

Modified

2026-10-17T10:30:33Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel

Details

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111706.json"
}

References

Affected packages

Git / github.com/vastxie/99ai

Affected ranges

Type

GIT

Repo

https://github.com/vastxie/99ai

Events

Introduced

Last Affected

cbebbfbd823c428f6aaae72d2f8e71cb785ef970

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "4.3.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v3.*

v3.0.0

v3.3.0

v3.5.0

v3.7.0

v4.*

v4.0.0

v4.1.0

v4.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111706.json"