Improper Access Control Vulnerability in Chuanhuchatgpt Could Lead to Data Breaches and Identity Theft

CVE-2024-4520

What is CVE-2024-4520?

An improper access control vulnerability in the Gaizhenbiao/ChuanhuChatGPT application, specifically in version 20240410, poses serious risks to user privacy. This flaw enables any user on the server to access the chat history of other users without any interaction. The exploitation of this vulnerability may lead to significant data breaches, resulting in exposure of sensitive personal details, financial data, and confidential conversations. It further opens avenues for identity theft and various fraudulent activities through unauthorized access to users' chat histories, rooted in insufficient access control mechanisms in managing chat data.

References