Authentication Bypass in 99AI API Endpoint

99AI versions 4.3.0 and earlier are affected by a critical missing authentication vulnerability identified as CVE-2026-111706. The issue resides in the POST /api/chatLog/exportExcel route. An unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request to the server, which does not verify the user's identity before processing the export task. By manipulating the request parameters - specifically the page, size, and optional email fields - an attacker can trigger the system to generate and download an Excel spreadsheet containing sensitive data. This data includes usernames, email addresses, prompts, and corresponding AI responses. This exposure poses a significant risk to user privacy and data confidentiality, particularly for organizations relying on the application for sensitive internal communications.

Impact

Successful exploitation of this vulnerability results in the unauthorized exfiltration of the entire user chat log database. Given that the exported records include personally identifiable information (PII) such as usernames and email addresses, as well as potentially sensitive internal prompts and responses, this exposure could lead to mass data breaches and violations of data protection regulations. The number of impacted users depends on the total log volume stored in the specific 99AI instance being targeted.

Recommendation

Prioritized actions for security and infrastructure teams:

• Upgrade the 99AI application to a patched version beyond 4.3.0 as soon as the vendor provides it.
• Implement access control lists (ACLs) or network segmentation to restrict access to the /api/chatLog/exportExcel endpoint to authenticated administrative users only.
• Monitor web server access logs for anomalous POST requests to the /api/chatLog/exportExcel endpoint, particularly those originating from unauthorized or external IP addresses.
• Deploy the provided Sigma rule to detect and flag exploitation attempts targeting this endpoint.