xiaozhi-esp32-server EUVD-2026-109275

Requires a valid authenticated manager-api account; the description states a normal or self-registered account suffices, so no administrative privilege is needed. The attacker must also know or enumerate another user's device MAC address to place in the /device/address-book/{macAddress} path. No special product configuration or user interaction is required, and the flaw is present in default deployments of versions before 0.9.8. The practical limiting factors are therefore the need for an account (PR:L) and knowledge of a target device MAC; impact is confined to reading address-book metadata (contact MACs, aliases, call permissions, owner user IDs) with no write or service-disruption capability.

This is a medium-severity information-disclosure flaw (IDOR/CWE-639), not a priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, 5.3) is internally consistent with the description: network-reachable, low attack complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only low confidentiality impact with no integrity or availability impact. No EPSS score and no KEV listing were supplied, and the vuln.today Decision label is 'this_month' rather than act_now/emergency, so the aggregate signals point to a real but non-urgent issue to remediate on a normal patch cadence. The one amplifying factor is that exploitation is trivial once authenticated - and self-registration is explicitly in scope, lowering the practical bar for PR:L - but the exposed data (contact MACs, aliases, call permissions, owner user IDs) is limited PII rather than credentials or code execution. There is no genuine conflict among the signals; the main missing data points are EPSS probability and any independent exploitation telemetry.

An attacker self-registers a normal account on a Xiaozhi-esp32-server manager-api instance, then calls /device/address-book/{macAddress} supplying the MAC address of a device belonging to another user. Because the pre-0.9.8 handler does not verify that the requesting user owns the device, the server returns that victim's address-book entries - contact MACs, aliases, call permissions, and owner user IDs. A public PoC reference (a HackMD write-up and VulnCheck advisory) exists but is not verified as working exploit code.