{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/99ai--4.3.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:99ai:99ai:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-111706"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["99AI (\u003c= 4.3.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["99AI"],"content_html":"\u003cp\u003e99AI versions 4.3.0 and earlier are affected by a critical missing authentication vulnerability identified as CVE-2026-111706. The issue resides in the POST /api/chatLog/exportExcel route. An unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request to the server, which does not verify the user's identity before processing the export task. By manipulating the request parameters - specifically the page, size, and optional email fields - an attacker can trigger the system to generate and download an Excel spreadsheet containing sensitive data. This data includes usernames, email addresses, prompts, and corresponding AI responses. This exposure poses a significant risk to user privacy and data confidentiality, particularly for organizations relying on the application for sensitive internal communications.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in the unauthorized exfiltration of the entire user chat log database. Given that the exported records include personally identifiable information (PII) such as usernames and email addresses, as well as potentially sensitive internal prompts and responses, this exposure could lead to mass data breaches and violations of data protection regulations. The number of impacted users depends on the total log volume stored in the specific 99AI instance being targeted.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and infrastructure teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the 99AI application to a patched version beyond 4.3.0 as soon as the vendor provides it.\u003c/li\u003e\n\u003cli\u003eImplement access control lists (ACLs) or network segmentation to restrict access to the /api/chatLog/exportExcel endpoint to authenticated administrative users only.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests to the /api/chatLog/exportExcel endpoint, particularly those originating from unauthorized or external IP addresses.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect and flag exploitation attempts targeting this endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:51:04Z","date_published":"2026-10-16T18:51:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-111706/","summary":"99AI versions 4.3.0 and earlier contain a missing authentication vulnerability in the /api/chatLog/exportExcel endpoint, enabling unauthenticated attackers to exfiltrate sensitive user chat logs.","title":"Authentication Bypass in 99AI API Endpoint","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-111706/"}],"language":"en","title":"CraftedSignal Threat Feed - 99AI (\u003c= 4.3.0)","version":"https://jsonfeed.org/version/1.1"}