Vendor
99AI versions 4.3.0 and earlier contain a missing authentication vulnerability in the /api/chatLog/exportExcel endpoint, enabling unauthenticated attackers to exfiltrate sensitive user chat logs.