Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck
CVE-2026-11170699AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
High 7.5
In plain English
A high-severity missing authentication in 99AI from vastxie. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 71.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor third-party-advisory
- https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.controller.ts#L47-L52 technical-description
- https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts#L104-L155 technical-description
- https://github.com/vastxie/99AI product
- VulnCheck Advisory: 99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel third-party-advisory