xinnan-tech CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM xinnan-tech CVE published 2026-10-24

CVE-2026-116017

The Xiaozhi-esp32-server before version 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler. Authenticated users can read other users' device address books by requesting /device/address-book/{macAddress} with another user's device MAC. This vulnerability allows unauthorized access to sensitive device address book information, potentia [truncated]