CVE-2026-4400 in 1millionbot Millie Chatbot

Zusammenfassung (Englisch)

Insecure Direct Object Reference (IDOR) vulnerability in 1millionbot Millie chat that allows private conversations of other users being viewed by simply changing the conversation ID. The vulnerability is present in the endpoint 'api.1millionbot.com/api/public/conversations/' and, if exploited, could allow a remote attacker to access other users private chatbot conversations, revealing sensitive or confidential data without requiring credentials or impersonating users. In order for the vulnerability to be exploited, the attacker must have the user's conversation ID.

Zuständig

INCIBE

Reservieren

18.03.2026

Veröffentlichung

31.03.2026

Einträge

VulDB provides additional information and datapoints for this CVE:

ID	Schwachstelle	CWE	Aus	Mas	CVE
354359	1millionbot Millie Chatbot conversations erweiterte Rechte	639	Nicht definiert	Nicht definiert	CVE-2026-4400