MEDIUMCVSS v3.1 4.2Vulnerability
CVE-2026-119048
JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-29T15:51:37.835109+00:00
- Cvss severity
- MEDIUM
- Cvss score
- 4.2
- Retrieved at
- 2026-10-29T15:52:27+00:00
- Score
- 4.2
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-119048
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- First seen by Signal
- 2026-10-29T15:52:27+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Published at
- 2026-10-29T14:17:51.650
- Last modified
- 2026-10-29T14:17:51.777
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph