Insecure Direct Object Reference in langchain4j-aideepin Product by Moyangzhan

CVE-2026-125386

What is CVE-2026-125386?

The langchain4j-aideepin product up to version 3.32.0 has a vulnerability that permits authenticated users to unintentionally access other users’ message references. This occurs due to insufficient owner verification within the CharacterMessageController logic. By manipulating message UUIDs, attackers can exploit endpoints such as knowledge-embedding-ref, memory-embedding-ref, and graph-ref to obtain sensitive information, including chunks of knowledge bases and long-term memory text. Immediate patching and regular security assessments are advised to mitigate potential unauthorized data access.

References