CVE-2026-4400 in 1millionbot Millie Chatbot

요약 (영어)

Insecure Direct Object Reference (IDOR) vulnerability in 1millionbot Millie chat that allows private conversations of other users being viewed by simply changing the conversation ID. The vulnerability is present in the endpoint 'api.1millionbot.com/api/public/conversations/' and, if exploited, could allow a remote attacker to access other users private chatbot conversations, revealing sensitive or confidential data without requiring credentials or impersonating users. In order for the vulnerability to be exploited, the attacker must have the user's conversation ID.

책임이 있는

INCIBE

예약하다

2026. 03. 18.

공개

2026. 03. 31.

엔트리

VulDB provides additional information and datapoints for this CVE:

아이디	취약성	CWE	악용	대책	CVE
354359	1millionbot Millie Chatbot conversations 권한 상승	639	정의되지 않음	정의되지 않음	CVE-2026-4400