CVE-2026-111706: 99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-16 · updated 2026-10-16
Weakness: CWE-306

Description

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.

Affected products

vastxie 99AI: through 4.3.0

References

https://github.com/vastxie/99AI
https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.controller.ts#L47-L52
https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts#L104-L155
https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor
https://www.vulncheck.com/advisories/99ai-through-4.3.0-unauthenticated-information-disclosure-via-chatlog-exportexcel

Get alerted when CVE-2026-111706 or the next vulnerability affects your stack