Unrated severityNVD Advisory· Published Oct 26, 2026· Updated Oct 26, 2026

CVE-2026-106677

Description

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Homestay3/homestay-backendllm-fuzzy
Range: 0.0.1-SNAPSHOT

Patches

Vulnerability mechanics

References

github.com/tao0845/CVE-Request/blob/main/CVE-2026-106677.mdnvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000