99AI CVE-2026-111706

No special conditions - remote unauthenticated exploitation against default configurations of 99AI (vastxie/99AI) version 4.3.0 and earlier. The only prerequisite is network reachability to the application's /api/chatLog/exportExcel endpoint; the route lacks any authentication guard (CWE-306), so no credentials, user interaction, or non-default settings are required. The attacker supplies page and size parameters (and an optional email field) in the POST body. The principal limiting factor is exposure scope: the instance must be network-reachable to the attacker, and impact is confined to disclosure of stored chat-log data (usernames, emails, prompts, AI answers) - there is no write, code-execution, or availability impact.

This is a genuine, high-priority exposure for anyone running 99AI, not a high-score-but-low-risk artifact. All available signals align: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H) describes network-reachable, low-complexity, fully unauthenticated access with high confidentiality impact (8.7 High), and CWE-306 (missing authentication) confirms the root cause is a complete absence of an auth check on the exportExcel route rather than a hard-to-hit memory bug. There is no integrity or availability impact (VI:N/VA:N), so this is a pure data-disclosure flaw. No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is not listed in CISA KEV, so there is no confirmed active exploitation - exploitation status is therefore 'no public exploit identified at time of analysis,' though this should be read alongside the fact that a public technical writeup (hackmd) documents the exact endpoint, parameters, and behavior, which materially lowers the barrier to opportunistic exploitation. The main factor tempering absolute risk is deployment footprint: 99AI is a niche open-source project, so real-world impact is bounded by how many instances are internet-exposed rather than by any technical difficulty of attack. Net: for exposed instances this is trivially exploitable and should be patched promptly; the aggregate threat is limited by prevalence, not by exploit difficulty.

An attacker discovers an internet-exposed 99AI instance (version ≤4.3.0) and, without any credentials, sends a POST request to /api/chatLog/exportExcel with controlled page and size parameters. The server returns an xlsx file containing every user's usernames, emails, prompts, and AI answers, letting the attacker bulk-harvest all stored conversation data. A public technical writeup documenting the endpoint and parameters exists, so reproduction requires no original research.