Medium severity6.8NVD Advisory· Published Oct 9, 2026
CVE-2026-108110
CVE-2026-108110
Description
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or /api/documents/save-blueprint to read private documents and overwrite presentation blueprints.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/himovo/movo/blob/v0.2.3/services/chat-api/app/api/endpoints/documents.pynvd
- github.com/himovo/movo/blob/v0.2.3/services/chat-api/app/api/endpoints/documents.pynvd
- hackmd.io/HfAnJ59RQuSNLYmNGkAKognvd
- www.vulncheck.com/advisories/movo-through-0.2.3-authorization-bypass-via-document-endpointsnvd
News mentions
0No linked articles in our index yet.