CVE Intelligence

Vastxie 99AI vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Vastxie 99AI: 2 record(s), with affected versions and fixes.

CVE-2026-111707 Medium · 5.3 CWE-639 Oct 16, 2026
99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.
CVE-2026-111706 High · 7.5 CWE-306 Oct 16, 2026
99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.