CVE-2026-111707 in 99AI
Summary
by MITRE • 10/16/2026
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The security flaw identified in 99AI versions through 4.3.0 represents a critical failure in access control mechanisms, specifically categorized as an Insecure Direct Object Reference or IDOR vulnerability within the CWE taxonomy. This type of weakness occurs when an application uses user-supplied input to directly access objects such as files, database records, or internal keys without performing adequate authorization checks. In this specific instance, the vulnerability resides within a function named querySingleChat which is designed to retrieve details for a single chat session. The core technical deficiency lies in the absence of an owner verification step before returning data associated with a given chat identifier. Consequently, the system trusts the client-provided chatId value as authoritative regarding ownership and access rights, failing to validate that the authenticated user making the request actually owns or is authorized to view the content linked to that specific identifier.
The operational impact of this vulnerability allows unauthenticated attackers to bypass authentication requirements entirely by leveraging a fingerprint header mechanism to obtain a visitor JSON Web Token. This token serves as a lightweight form of session identification, granting limited but sufficient privileges to interact with certain API endpoints. Once an attacker possesses this visitor JWT, they can exploit the lack of authorization checks in the querySingleChat function by iterating through sequential chatId values. Because the application does not verify that the requesting user is associated with the target chatId, the system returns sensitive data for any valid identifier encountered during the iteration process. This enables the systematic enumeration and exfiltration of private conversation histories, including message content and associated task data belonging to other users who are actively using the platform.
From a threat modeling perspective, this vulnerability aligns closely with MITRE ATT&CK technique T1078, which covers Valid Accounts, as well as aspects of T1530, Data from Local System, due to the unauthorized retrieval and exfiltration of stored data. The ability to read other users' chat messages constitutes a severe breach of confidentiality and privacy, potentially exposing personally identifiable information, proprietary business discussions, or sensitive operational details depending on the user base. Furthermore, the exposure of task data may reveal workflow structures, project timelines, or internal processes that could be leveraged for further social engineering attacks or targeted exploitation against specific individuals within an organization using the platform.
To mitigate this vulnerability, developers must implement strict object-level authorization checks at every point where external identifiers are used to access resources. Specifically, the querySingleChat function should validate that the user identity derived from the JWT matches the owner field associated with the requested chatId in the backend database or storage system. If a mismatch is detected, the server must return an appropriate error code indicating insufficient permissions rather than returning the data. Additionally, implementing rate limiting on endpoints susceptible to enumeration attacks can reduce the efficiency of iterative scraping attempts. Regular security audits and static application security testing focused on access control logic are recommended to prevent similar IDOR flaws in future releases.