CVE-2026-111706
Deferred Deferred - Pending Action

Authentication Bypass in 99AI Exports Chat Logs

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111706
EUVD
EUVD-2026-102998

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vastxie 99AI 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication issue in 99AI versions up to 4.3.0. It allows unauthenticated attackers to export all users' chat logs via the POST /api/chatLog/exportExcel route. Attackers can manipulate parameters like page, size, and email to download xlsx files containing sensitive data such as usernames, emails, prompts, and AI responses.

Detection Guidance

Check for unauthorized access to the POST /api/chatLog/exportExcel endpoint by monitoring HTTP logs for requests to this path without valid authentication tokens. Look for unusual xlsx file downloads from this route.

Impact Analysis

This vulnerability can lead to severe privacy breaches. Attackers may gain access to confidential user data, including chat histories, personal information, and sensitive communications. This could result in identity theft, corporate espionage, or reputational damage if exploited.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires strict protection of personal data, while HIPAA mandates safeguards for protected health information. Exploitation could lead to legal penalties, fines, and mandatory breach notifications.

Mitigation Strategies

Immediately restrict access to the POST /api/chatLog/exportExcel route by implementing authentication checks. Update 99AI to the latest version if a patch is available. Monitor network traffic for suspicious activity targeting this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart