CVE-2026-121938
Received Received - Intake

Insecure Direct Object Reference in langchain4j-aideepin

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121938
EUVD
EUVD-2026-116895

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moyangzhan langchain4j-aideepin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in langchain4j-aideepin versions before 3.31.0. It allows authenticated users to read other users' private character-chat conversations by supplying a character UUID. The CharacterService.detail endpoint does not verify ownership, enabling attackers to access victims' questions, AI answers, attachment URLs, and audio URLs.

Detection Guidance

To detect this vulnerability, check if your langchain4j-aideepin instance is running version 3.30.0 or earlier. Inspect server logs for unauthorized GET requests to /character/{uuid} endpoints. Verify if CharacterService.detail lacks ownership checks by reviewing the service implementation.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to your private conversations, including questions, AI responses, and shared attachments or audio files. Attackers only need a valid session token and your character UUID to view this sensitive data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal and sensitive data without authorization. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized access to conversations could result in non-compliance and legal consequences.

Mitigation Strategies

Upgrade langchain4j-aideepin to version 3.31.0 or later. Ensure CharacterService.detail enforces ownership checks by comparing user IDs. Review and update all message retrieval endpoints to include user ID filters in queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121938. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...