Insecure Direct Object Reference in Xiaozhi-esp32-server Affects User Data Privacy

CVE-2026-116017

What is CVE-2026-116017?

The Xiaozhi-esp32-server prior to version 0.9.8 is susceptible to an insecure direct object reference vulnerability in its DeviceController.getAddressBook handler. This flaw permits authenticated users, including those with normal or self-registered accounts, to access other users' device address books by exploiting the API endpoint /device/address-book/{macAddress}. An attacker can gain insights into contact MACs, aliases, call permissions, and user IDs of the device owner by substituting the MAC address with that of another user, raising serious concerns about user data privacy and security.

References