Authorization Bypass Vulnerability in REBUILD Product by Vendor

CVE-2026-110611

What is CVE-2026-110611?

The REBUILD product through version 4.5.0 contains an authorization bypass vulnerability within the AiBot2Controller endpoints. This flaw allows authenticated low-privilege users to gain unauthorized access to functionalities that should verify ownership over provided chat IDs. By exploiting this vulnerability, users can interact with actions such as chat-init, chat-delete, chat-feedback, or chat-stream-stop, gaining the ability to read, delete, exfiltrate, or interrupt private AI assistant conversations, thereby posing a significant privacy risk.

References