CVE-2026-110611 getrebuild CVE debrief

Who should care

Defenders responsible for authentication and authorization controls, low-privilege user account management, and monitoring chat endpoint activity should be aware of this vulnerability. They should assess and update authentication and authorization controls, verify chatid validation, and monitor chat endpoint activity to prevent unauthorized access to AI assistant conversations. Additionally, security teams and vulnerability management teams should review 4

Why it matters

CVE-2026-110611 is a medium-severity vulnerability in REBUILD through 4.5.0 that allows authenticated low-privilege users to bypass authorization and access or manipulate AI assistant conversations. Defenders should assess and update authentication and authorization controls, verify chatid validation, and monitor chat endpoint activity.

• Read, delete, exfiltrate, or interrupt AI assistant conversations
• Potential data exposure or loss
• Compromise of AI assistant functionality
• Need for verification of chatid validation and ownership checks

Technical summary

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. This vulnerability allows authenticated low-privilege users to bypass authorization and access or manipulate AI assistant conversations, potentially leading to data exposure or loss, and disruption of AI services. The vulnerability is a result of insufficient validation of the chatid parameter, allowing an attacker to supply another user's chatid and gain unauthorized access to their AI assistant conversations.

Defensive priority

Medium priority for authentication and authorization control assessments

Recommended defensive actions

• Assess authentication and authorization controls for aibot2 chat endpoints
• Verify chatid validation and ownership checks
• Review and update access controls for low-privilege users
• Monitor for suspicious activity on chat-init, chat-delete, chat-feedback, and chat-stream-stop endpoints
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

Official CVE Program record and NIST NVD detail page provide vulnerability metadata. Source item and supplemental references offer additional context. The CVE record was published on 2026-10-14T14:16:51.948Z and has not been modified since then. There are no known affected deployments in managed environments. The official advisory and CVE record should be reviewed to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.