Insecure Direct Object Reference in abp-next-admin by LINGYUN
CVE-2026-111630

5.3MEDIUM

Key Information:

Vendor

Colinin

Status
Abp-next-admin
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111630?

The abp-next-admin application versions 10.2.0 through 10.6.0 are affected by an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module. This flaw allows authenticated users to access the AI chat conversations of other users by simply providing the associated ConversationId. Attackers granted the Chat permission can leverage this vulnerability by invoking methods like ChatAppService.GetListAsync or SendMessageAsync with a user's ConversationId, thus gaining unauthorized access to read and inject messages into a victim's chat conversation.

Affected Version(s)

abp-next-admin 10.2.0 <= 10.6.0

References

https://hackmd.io/@hieuPenguinnn/abp-next-admin-aimanagem...
third-party-advisory
https://github.com/colinin/abp-next-admin/blob/10.6.0/asp...
technical-description
https://github.com/colinin/abp-next-admin/blob/10.6.0/asp...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.