99AI CVE-2026-111707

Requires that the 99AI instance (≤ 4.3.0) exposes the chatLog querySingleChat API and the visitor-login/fingerprint JWT mechanism, both of which are default behavior - the attacker sends a fingerprint header to be issued a visitor JWT and then iterates sequential integer chatId values. No authentication, user interaction, or non-default configuration is required. The only practical limiting factor is that chatId values are sequential and therefore guessable/enumerable, and exposure is confined to chat message and task content (read-only); no write, admin, or system-level access is granted.

The source-provided CVSS 4.0 vector scores 6.9 (Medium): AV:N/AC:L/AT:N/PR:N/UI:N means a remote, unauthenticated, low-complexity attack with no user interaction, which makes exploitation trivial and reliable. However, impact is deliberately bounded - VC:L with VI:N/VA:N and SC/SI/SA:N - so the only consequence is limited disclosure of other users' chat message and task content, with no integrity, availability, or scope impact. These signals are consistent rather than conflicting: easy to exploit, modest impact. No EPSS score is present in the input, so real-world exploitation probability is unknown and cannot be asserted; the CVE is not listed in CISA KEV, so there is no confirmed active exploitation. A detailed public technical writeup (hackmd) and direct links to the vulnerable source code are provided, meaning the exploitation method is publicly documented and easily reproducible. SSVC decision data (exploitation/automatable/technical impact) was not supplied and cannot be synthesized. Net: this is a credible, easy-to-exploit confidentiality issue but not a catastrophic RCE/takeover; priority should be driven by whether 99AI is deployed with sensitive chat data, tempered by the product's limited deployment footprint.

An unauthenticated attacker sends a crafted fingerprint header to the application to mint a low-privilege 'visitor' JWT, then calls the querySingleChat API repeatedly while incrementing a sequential chatId value. Because querySingleChat performs no owner check, each request returns another user's chat messages and associated task data, letting the attacker harvest conversation content at scale. A public technical writeup documenting this exact unauthenticated export and IDOR chain exists, so the technique is reproducible without original research.