Vulnerability record/PUBLISHED/Published Nov 9, 2026 23:27:53 UTC
CVE-2026-125386
langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to missing owner checks. Attackers can supply another user's message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints to retrieve knowledge-base chunks, long-term memory text, and knowledge-graph data.
Base score6.0/ 10
SeverityMediumCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityHighAC
Attack requirementsPresentAT
Privileges requiredLowPR
User interactionNoneUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 9, 2026 23:27:53 UTC
PublishedNov 9, 2026 23:27:53 UTC
ReservedNov 9, 2026 22:03:09 UTC
Credits
- hieuPenguinnn