CVE-2026-110611

Deferred Deferred - Pending Action

Authorization Bypass in REBUILD AiBot2Controller

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110611

EUVD

EUVD-2026-101239

Affected Vendors & Products

Vendor	Product	Version / Range
getrebuild	rebuild	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an authorization bypass vulnerability in REBUILD versions up to 4.5.0. Authenticated low-privilege users can manipulate the chatid parameter in AiBot2Controller endpoints to access, delete, or interrupt other users' AI assistant conversations without proper ownership verification.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access to REBUILD's AiBot2Controller endpoints (/aibot2/post/chat-init, /aibot2/post/chat-delete, /aibot2/post/chat-feedback, /aibot2/post/chat-stream-stop). Check logs for requests with chatid parameters not matching the authenticated user's ID. Use tools like curl to test endpoints with arbitrary chatid values to verify improper access controls.

Impact Analysis

An attacker with low privileges could read your private AI assistant conversations, delete them permanently, submit feedback containing your chat logs to the vendor, or interrupt ongoing AI responses. This exposes sensitive data and disrupts AI services.

Compliance Impact

This vulnerability likely violates GDPR's data protection principles by enabling unauthorized access to personal data in AI conversations. It may also breach HIPAA if protected health information is exposed through compromised chat sessions.

Mitigation Strategies

Immediately update REBUILD to the latest version beyond 4.5.0. As a temporary fix, restrict access to the vulnerable endpoints via network policies or application-level controls. Implement strict ownership verification for all chatid parameters in AiBot2Controller endpoints. Review logs for signs of exploitation and revoke any unauthorized access.

Hi! I’m here to help you understand CVE-2026-110611. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70