PT-2026-136958
CVE-2026-121938
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs.
Found an issue in the description? Have something to add? Feel free to write us 👾