---
cve: "CVE-2026-111706"
severity: "HIGH"
cvss: 8.7
epss: "0.4%"
vendor: "vastxie"
kev: false
exploited: false
published: "2026-10-16 18:17:54"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-29T10:42:22+01:00"
---

# CVE-2026-111706

> 8.7 HIGH · 🧪 PoC

## Beschreibung

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-10-16 21:16:51
- CNA-CVSS: **8.7** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-306** — Missing Authentication for Critical Function
  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

## Angriffsmuster (CAPEC)

- [CAPEC-12 — Choosing Message Identifier](https://capec.mitre.org/data/definitions/12.html) _(Severity: High)_
- [CAPEC-36 — Using Unpublished Interfaces or Functionality](https://capec.mitre.org/data/definitions/36.html) _(Severity: High)_
- [CAPEC-62 — Cross Site Request Forgery](https://capec.mitre.org/data/definitions/62.html) _(Severity: Very High)_
- [CAPEC-166 — Force the System to Reset Values](https://capec.mitre.org/data/definitions/166.html) _(Severity: Medium)_
- [CAPEC-216 — Communication Channel Manipulation](https://capec.mitre.org/data/definitions/216.html)

## Referenzen

- <https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor>
- <https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.controller.ts#L47-L52>
- <https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts#L104-L155>
- <https://github.com/vastxie/99AI>
- <https://www.vulncheck.com/advisories/99ai-through-4.3.0-unauthenticated-information-disclosure-via-chatlog-exportexcel>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-111706/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_