CVE-2026-108110

Name of the Vulnerable Software and Affected Versions MOVO versions prior to 0.2.4

Description An authorization bypass exists in the chat-api document endpoints. Authenticated users can access stored objects belonging to other users by providing arbitrary object paths. By sending a known target object path to the '/api/documents/fetch' or '/api/documents/save-blueprint' endpoints, an attacker can read private documents or overwrite presentation blueprints.

Recommendations Update MOVO to version 0.2.4 or later. Restrict access to the '/api/documents/fetch' and '/api/documents/save-blueprint' endpoints to minimize the risk of exploitation.