High severity7.5NVD Advisory· Published Oct 16, 2026· Updated Oct 16, 2026
CVE-2026-111706
CVE-2026-111706
Description
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.controller.tsnvd
- github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.tsnvd
- hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idornvd
- www.vulncheck.com/advisories/99ai-through-4.3.0-unauthenticated-information-disclosure-via-chatlog-exportexcelnvd
News mentions
0No linked articles in our index yet.