CVE-2026-106677
High · 7.1CVSS
7.1
EPSS
0.2%
Published
Oct 26, 2026
CISA due date
—
The record
Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121734 ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows… CWE-639
- CVE-2026-121732 RosarioSIS before 12.9 contains an improper authorization vulnerability that allows… CWE-639
- CVE-2026-121582 A vulnerability has been found in Umami up to 3.4.1. CWE-639
- CVE-2026-116669 Tanium addressed an improper access controls vulnerability in Discover. CWE-639
- CVE-2026-121631 Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the… CWE-639
- CVE-2026-115292 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can… CWE-639
- CVE-2026-115295 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to… CWE-639
- CVE-2026-121560 LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that… CWE-639