langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to missing owner checks. Attackers can supply another user's message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints to retrieve knowledge-base chunks, long-term memory text, and knowledge-graph data.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 09 Nov 2026 23:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to missing owner checks. Attackers can supply another user's message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints to retrieve knowledge-base chunks, long-term memory text, and knowledge-graph data. | |
| Title | langchain4j-aideepin through 3.32.0 IDOR via /character/message reference endpoints | |
| Weaknesses | CWE-639 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-09T23:27:53.127Z
Reserved: 2026-11-09T22:03:09.881Z
Link: CVE-2026-125386
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses