Authorization Bypass in Tamery Affects Cloud Sync API for Chat Messages

CVE-2026-119664

What is CVE-2026-119664?

Tamery versions prior to 0.99.0 are susceptible to an authorization bypass that affects the cloud sync API. Specifically, the issue resides in the 'chatsMessages.update' handler, which inadvertently allows authenticated Pro subscribers to manipulate chat history. By gaining knowledge of another user's chat ID, attackers can transfer messages and associated metadata into the victim's AI chat records, compromising user privacy and security. It's crucial for users of Tamery to update to versions 0.99.0 or later to mitigate this vulnerability.

References