Vedo Suite CVE-2026-51367

The api_vedo/chat endpoint must be reachable from the attacker's network position - internet-exposed deployments are highest risk. The CVSS vector PR:N combined with the 'Authentication Bypass' tag indicates no valid session or credentials are required to invoke the endpoint and receive chat data. The attacker must supply a valid value for the utente_chat parameter; usernames or user IDs in chat systems are frequently predictable, sequential, or discoverable via enumeration. No special operating system, platform, or non-default configuration is required - this affects standard Vedo Suite 1.2.5 deployments. Exploitation is strictly limited to confidentiality loss of chat message content; the CVSS vector confirms no integrity (I:N) or availability (A:N) impact.

The CVSS 3.1 base score of 7.5 (High) is driven by network-accessible exploitation (AV:N), low complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H). The EPSS score of 0.24% at the 16th percentile is notably low, suggesting this has not attracted mass exploitation tooling at time of analysis - consistent with a niche vendor product with limited global deployment. There is no CISA KEV listing. The gap between the high CVSS and low EPSS is characteristic of a real, technically exploitable vulnerability targeting a low-prevalence product rather than a high-noise issue. The 'Authentication Bypass' tag amplifies the risk beyond a typical IDOR: if the endpoint genuinely requires no session token, any network-reachable attacker can extract any user's chat history by iterating user identifiers. The confidentiality impact is real but scoped to chat message content within this specific application. No integrity or availability impact is indicated.

A remote attacker identifies a network-accessible Vedo Suite 1.2.5 instance and sends an unauthenticated HTTP request to the api_vedo/chat endpoint, supplying a known or enumerated username in the utente_chat parameter. The server responds with that user's chat history without verifying session ownership or authorization, leaking potentially sensitive communications. The Elmec blog post documents this technique, suggesting the exploitation method is publicly understood even if no automated exploit tool has been confirmed.