Authorization Bypass in MOVO Chat-API Document Endpoints by Himovo
CVE-2026-108110

7.6HIGH

Key Information:

Vendor: Himovo
Status: Movo
Vendor: CVE Published:; 9 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-108110?

MOVO versions up to 0.2.3 contain a vulnerability in the chat-api document endpoints, allowing authenticated users to bypass authorization checks. This flaw enables attackers to access the stored objects of other users by supplying arbitrary object paths. By knowing a target's object path, malicious actors can exploit the endpoints /api/documents/fetch and /api/documents/save-blueprint to read private documents and overwrite presentation blueprints, posing significant security risks.

Affected Version(s)

MOVO 0.1.0 <= 0.2.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-108110 - Proof of Concept