Insecure Direct Object Reference in JeeSite AI CMS Chat Module

Executive Summary

CVE-2026-119048 is an Insecure Direct Object Reference (IDOR) vulnerability in JeeSite 5.11.0 through 5.19.1's AI CMS chat module. It allows authenticated users to access, modify, or delete other users' chat conversations by exploiting missing or reversed ownership checks. Attackers can read, delete, or append messages to a victim's chat transcripts if they know or can derive the conversation ID.

The flaw occurs because endpoints like /a/cms/chat/message or /a/cms/chat/delete lack proper permission validation. Ownership checks are either missing or incorrectly implemented, enabling unauthorized access to shared cache-based message storage.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access to endpoints like /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions. Check logs for repeated requests to these endpoints with varying conversation IDs. Verify if users can access conversations not belonging to them by testing with known conversation IDs.

Useful 0 Not Useful 0

Impact Analysis

If you use JeeSite 5.11.0 to 5.19.1 with the AI CMS chat module, an attacker with a valid account could access your private AI chat conversations. They could read sensitive messages, delete your conversation history, or inject malicious content into your chats. Exploitation requires knowing your conversation ID, which may be derived from predictable IDs or leaked data.

Useful 0 Not Useful 0

Compliance Impact

This IDOR vulnerability could lead to unauthorized access to personal or sensitive data in chat transcripts, violating GDPR's data protection principles (e.g., Article 5 on lawfulness and transparency) and HIPAA's requirements for safeguarding protected health information. Organizations using affected JeeSite versions may face compliance breaches, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest patch from JeeSite to fix the ownership checks in the AI CMS chat module. Ensure all endpoints validate conversation ownership before granting access. Restrict access to sensitive endpoints and monitor for unusual activity. Update to JeeSite 5.19.2 or later to resolve the issue.

Useful 0 Not Useful 0