EUVD-2026-103052
GHSA-qwvq-vvf9-6fhj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Chat permission
-
DeliveryObtain victim ConversationId GUID
-
ExploitCall GetListAsync with victim ConversationId
-
ExecutionRead victim chat messages
-
ImpactInject messages via SendMessageAsync
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated account on the abp-next-admin instance that holds the Chat permission (PR:L); it is not exploitable by anonymous/unauthenticated users. The attacker must additionally know or obtain the target's ConversationId, which is a GUID - because GUIDs are not easily guessed or enumerated, practical exploitation depends on the attacker acquiring the identifier out-of-band, meaningfully limiting opportunistic abuse. Affected deployments are those running the LINGYUN.Abp.AIManagement module in versions 10.2.0 through 10.6.0; no special non-default configuration beyond having the chat feature and Chat permission enabled is indicated. |
| Impact | This is a moderate-severity, authenticated authorization flaw (CWE-639, IDOR) rather than a critical remote threat. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and is internally consistent with the description: exploitation is network-reachable and low-complexity but requires an authenticated account (PR:L) holding the Chat permission, and impact is limited to low confidentiality and low integrity (VC:L/VI:L, VA:N) scoped to the AIManagement chat module. No EPSS score, CISA KEV listing, or POC flag is present in the input, so there is no signal of active or probable exploitation; the referenced hackmd writeup and source-code links are technical analysis, not a confirmed weaponized exploit. A practical limiter not fully captured by the CVSS score is that exploitation depends on knowing a victim's ConversationId, which is a GUID - GUIDs are not readily enumerable, reducing opportunistic mass exploitation and pushing this toward targeted abuse by an already-authenticated insider. Net: a real but low-urgency issue, not a high-priority emergency. |
| Exploit ScenarioDerived | An authenticated user of an abp-next-admin deployment who holds the Chat permission obtains or discovers another user's ConversationId GUID (e.g., via logs, shared links, or referrals) and calls ChatAppService.GetListAsync to read that victim's private AI chat history, then uses SendMessageAsync to inject messages into the victim's conversation. A technical writeup detailing the flaw exists (hackmd), but no weaponized public exploit is flagged in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Authenticated users of abp-next-admin 10.2.0 through 10.6.0 who hold the Chat permission can read, and inject messages into, other users' AI chat conversations by supplying a victim's ConversationId GUID to ChatAppService.GetListAsync or SendMessageAsync in the LINGYUN.Abp.AIManagement module. The flaw is a moderate-severity authorization error (CWE-639, IDOR) rather than an unauthenticated remote compromise: exploitation requires a valid account holding the Chat permission (PR:L per the assessed vector) plus knowledge of the target's GUID, which is not readily guessable, so opportunistic abuse is limited. There is confirmed actively exploited status absent (CISA KEV), no public exploit identified at time of analysis, and exploitation is constrained by the out-of-band acquisition of the ConversationId; the advisory and vendor source code are publicly referenced, but that is technical documentation, not weaponized exploit code.
RemediationAI
No vendor-released patch identified at time of analysis; the only upstream references are the vulnerable 10.6.0 source files, so administrators cannot rely on a fixed version number and must treat remediation as an authorization hardening task. The most effective compensating control is to stop the identifier from being a free-form client input by adding an ownership/membership check in ChatAppService.GetListAsync and SendMessageAsync (and/or ConversationStore) that resolves the ConversationId against the calling user's own conversation list before returning or writing data, then rebuilding the module; this fixes the root cause but requires code changes and a redeploy of the affected service. Where code changes are not feasible, remove the Chat permission from all non-essential roles so that only trusted users can call the chat endpoints, at the cost of disabling AI chat for the broader user base; or disable/unregister the LINGYUN.Abp.AIManagement module entirely, which eliminates the exposure but removes the AI chat feature. Additionally, restrict network access to the chat API endpoints to trusted networks or an authenticated reverse proxy, ensure ConversationId GUIDs are never logged, embedded in client-side bundles, or exposed in URLs and shared links (the primary way an attacker would obtain a victim's identifier), and monitor application logs for GetListAsync or SendMessageAsync calls where the requested ConversationId does not belong to the authenticated caller. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/abp-next-admin-10.2.0-through-10.6.0-idor-in-aimanagement-chat-conversations and the source references above for confirmation of an upstream fix before treating any version as patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
abp-next-admin is an open-source admin framework built on the ABP Framework (.NET/C#), and CPE cpe:2.3:a:colinin:abp-next-admin confirms the colinin repository as the affected product. The vulnerable component is the LINGYUN.Abp.AIManagement module, which exposes ABP application services for AI chat: ChatAppService.GetListAsync and SendMessageAsync accept a ConversationId and pass it into ConversationStore (see the referenced ChatAppService.cs lines 27-52 and ConversationStore.cs lines 49-66 at tag 10.6.0). The code resolves and returns conversation data keyed solely by the client-supplied identifier without verifying that the caller owns or is a member of that conversation, the classic CWE-639 authorization bypass through a user-controlled key. Because the identifier is a GUID rather than a sequential integer, the attack surface is narrowed to scenarios where an attacker learns a victim's ConversationId, but once known, the same key grants both read access to chat history and the ability to post messages into the victim's conversation, i.e., limited confidentiality and integrity impact (VC:L/VI:L) with no availability impact.
Know when Abp Next Admin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable and low-complexity but requires an authenticated Chat-permission account (PR:L); low confidentiality and integrity impact from reading and injecting chat messages, no availability impact, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call ChatAppService.GetListAsync or SendMessageAsync with a victim's ConversationId GUID to read chat messages and inject messages into that conversation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB