CVE-2026-111706 vastxie CVE debrief

Who should care

Defenders responsible for 99AI instances, especially those with publicly accessible APIs, should assess exposure and potential impact. Security teams handling sensitive information and AI-related systems should prioritize verification and remediation efforts.

Why it matters

CVE-2026-111706 is a high-severity vulnerability allowing unauthenticated export of chat logs in 99AI through version 4.3.0. Defenders should prioritize verifying exposure, assessing impact, and updating instances to prevent potential data exposure.

• Potential exposure of sensitive user information
• Risk of unauthorized access to chat logs
• Need for verification of 99AI instance exposure
• Priority for updating to a secure version if available

Technical summary

The vulnerability exists in the POST /api/chatLog/exportExcel route of 99AI through version 4.3.0, allowing unauthenticated attackers to export all users' chat logs by sending requests with controlled page, size, and optional email fields. This results in xlsx files containing sensitive information such as usernames, emails, prompts, and AI answers. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity. Defenders should prioritize verifying exposure of 99AI instances, especially those with publicly accessible APIs, and assess the potential impact of chat log data exposure.

Defensive priority

Defenders should prioritize verifying exposure of 99AI instances, especially those with publicly accessible APIs, and assess the potential impact of chat log data exposure.

Recommended defensive actions

• Verify 99AI instance exposure, especially for publicly accessible APIs
• Assess potential impact of chat log data exposure
• Review and update 99AI instances to the latest version if available
• Monitor for suspicious activity related to chat log export
• Perform vulnerability scanning to identify exposed instances
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is confirmed in 99AI version 4.3.0 and earlier. The CVE record and NVD entry provide details on the vulnerability, but additional information about affected versions or remediation is not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.