CVE-2026-121938: IDOR exposes other users'

CISO Take

langchain4j-aideepin before 3.31.0 has an insecure direct object reference in GET /character/{uuid}: CharacterService.detail never checks ownership, so any authenticated user can read another user's character-chat history, including their questions, the AI's answers, and attachment and audio URLs. Exploitation is rated high complexity because the attacker needs a valid account and must obtain or guess the victim's character UUID. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template, so near-term mass exploitation looks unlikely. The impact is still a confidentiality breach, and AI chat histories often contain sensitive business or personal data. Upgrade to 3.31.0 or later (fix commit 9b2fee6), and review access logs for GET /character/{uuid} requests from users who don't own the UUID.

Sources:NVDATLASVulnCheck advisoryGitHub (langchain4j-aideepin repository)

What is the risk?

Medium (CVSS 5.3). The attack is network-reachable and needs only low privileges and no user interaction. The high attack complexity comes from having to learn a victim's character UUID, since UUIDs are not sequential. Confidentiality impact is high; integrity and availability are unaffected. There is no EPSS data, no KEV listing and no known public exploit, so near-term exploitation likelihood is low. Exposure is highest for multi-tenant or internet-facing deployments that allow open registration, where any attacker can get the low-privilege account needed. The project is a niche open-source application, and downstream dependents are unknown.

How does the attack unfold?

Initial Access

The attacker registers or uses a valid low-privilege account on the target instance.

AML.T0012

Exploitation

The attacker sends GET /character/{uuid} with a victim's UUID, and the server returns the record without an ownership check.

AML.T0049

Collection

The attacker reads the victim's questions, AI answers and attachment and audio URLs.

AML.T0085

Impact

Confidential conversation data is exposed, causing privacy loss and possible follow-on abuse of leaked files or secrets.

Initial Access

The attacker registers or uses a valid low-privilege account on the target instance.

AML.T0012

Exploitation

The attacker sends GET /character/{uuid} with a victim's UUID, and the server returns the record without an ownership check.

AML.T0049

Collection

The attacker reads the victim's questions, AI answers and attachment and audio URLs.

AML.T0085

Impact

Confidential conversation data is exposed, causing privacy loss and possible follow-on abuse of leaked files or secrets.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade langchain4j-aideepin to 3.31.0 or later, which adds the ownership check (commit 9b2fee6, PR #117). 2) If you cannot patch right away, restrict access to the application, disable open self-registration, or block GET /character/{uuid} at a reverse proxy or WAF for non-owners. 3) Review access logs for GET /character/{uuid} requests where the authenticated user is not the owner, and for enumeration or high-volume UUID probing. 4) Make sure attachment and audio storage URLs are signed, expiring or access-controlled, so leaked links can't be reused. 5) If you find signs of exploitation, notify the affected users and rotate any secrets that appeared in chats.

How is it classified?

Data LeakageAuth BypassPrivacy ViolationFrameworkAPIAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0085- Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from identified AI risks

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-121938?

langchain4j-aideepin before 3.31.0 has an insecure direct object reference in GET /character/{uuid}: CharacterService.detail never checks ownership, so any authenticated user can read another user's character-chat history, including their questions, the AI's answers, and attachment and audio URLs. Exploitation is rated high complexity because the attacker needs a valid account and must obtain or guess the victim's character UUID. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template, so near-term mass exploitation looks unlikely. The impact is still a confidentiality breach, and AI chat histories often contain sensitive business or personal data. Upgrade to 3.31.0 or later (fix commit 9b2fee6), and review access logs for GET /character/{uuid} requests from users who don't own the UUID.

Is CVE-2026-121938 actively exploited?

No confirmed active exploitation of CVE-2026-121938 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-121938?

1) Upgrade langchain4j-aideepin to 3.31.0 or later, which adds the ownership check (commit 9b2fee6, PR #117). 2) If you cannot patch right away, restrict access to the application, disable open self-registration, or block GET /character/{uuid} at a reverse proxy or WAF for non-owners. 3) Review access logs for GET /character/{uuid} requests where the authenticated user is not the owner, and for enumeration or high-volume UUID probing. 4) Make sure attachment and audio storage URLs are signed, expiring or access-controlled, so leaked links can't be reused. 5) If you find signs of exploitation, notify the affected users and rotate any secrets that appeared in chats.

What systems are affected by CVE-2026-121938?

This vulnerability affects the following AI/ML architecture patterns: LLM chat applications, Multi-tenant AI chat platforms, LangChain4j-based Java applications.

What is the CVSS score for CVE-2026-121938?

CVE-2026-121938 has a CVSS v3.1 base score of 5.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

LLM chat applicationsMulti-tenant AI chat platformsLangChain4j-based Java applications

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0085Data from AI Services

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs.

Exploitation Scenario

An attacker registers a normal account on a publicly reachable aideepin instance. They obtain a victim's character UUID, for example from a shared link, a leaked log or a referrer header. They then call GET /character/{uuid} with their own session. Because CharacterService.detail resolves the record without checking the owner, the server returns the victim's full conversation. The attacker reads the victim's questions and the AI's answers, and collects attachment and audio URLs to download the files. They repeat this for every UUID they can collect.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.