Insecure Direct Object Reference in JeeSite AI CMS Chat Module
CVE-2026-119048

2.3LOW

Key Information:

Vendor

Thinkgem

Status
Jeesite
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119048?

The JeeSite AI CMS chat module versions 5.11.0 to 5.19.1 contain a vulnerability that allows authenticated users to exploit insecure direct object references. This issue arises from insufficient ownership checks, enabling attackers to access other users' conversations by knowing or guessing conversation IDs. By exploiting endpoints such as /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions, unauthorized access to chat transcripts can occur, potentially compromising user privacy and data integrity.

Affected Version(s)

JeeSite 5.11.0 <= 5.19.1

References

https://github.com/thinkgem/jeesite5/issues/43
issue-tracking
https://github.com/thinkgem/jeesite5
product
https://github.com/thinkgem/jeesite5/commit/cbc5ba7a37fd9...
patch

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
ThinkGem
.