Missing Authentication Vulnerability in 99AI Software by Vastxie
CVE-2026-111706

8.7HIGH

Key Information:

Vendor

Vastxie

Status
99ai
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111706?

The 99AI software, up to version 4.3.0, contains a missing authentication vulnerability in its /api/chatLog/exportExcel endpoint. This issue permits unauthorized attackers to exploit the system and retrieve sensitive chat logs of all users. By crafting requests with controlled parameters such as page, size, and optional email fields, attackers can download Excel files containing usernames, emails, prompts, and corresponding AI-generated responses, posing significant risks to user privacy and data integrity.

Affected Version(s)

99AI 0 <= 4.3.0

References

https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-expo...
third-party-advisory
https://github.com/vastxie/99AI/blob/v4.3.0/service/src/m...
technical-description
https://github.com/vastxie/99AI/blob/v4.3.0/service/src/m...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.