Insecure Direct Object Reference in langchain4j-aideepin Product by Moyangzhan

CVE-2026-121938

What is CVE-2026-121938?

The langchain4j-aideepin product before version 3.31.0 is susceptible to an insecure direct object reference vulnerability. Authenticated users can exploit this issue to access other users' private character-chat conversations by manipulating the character UUID in their requests. This leads to unauthorized access to sensitive data, including users' questions, AI-generated answers, and associated attachment and audio URLs. The flaw arises as the CharacterService.detail method does not enforce proper ownership checks, allowing the exploitation of user data across sessions.

References