MOVO EUVD-2026-95883

Requires (1) a valid authenticated MOVO account, since the chat-api document endpoints are reachable only to logged-in users (PR:L), and (2) prior knowledge or enumeration of the target victim's object path, which is the AT:P attack requirement. The vulnerable surface is specifically /api/documents/fetch (read private documents) and /api/documents/save-blueprint (overwrite presentation blueprints), which fail to verify that the supplied object path belongs to the requesting user. Limiting factors for defenders: exploitation is impossible without an account, and the attacker must supply a valid object path belonging to another user, so success depends on paths being known, leaked, or guessable rather than fully attacker-controlled; no victim user interaction is required.

Signals are moderately consistent and point to a real but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) describes a network-reachable flaw requiring an authenticated low-privilege account (PR:L) plus a specific attack requirement (AT:P) - namely prior knowledge of the victim's object path - with high confidentiality and integrity impact to the vulnerable system (VC:H/VI:H) and no availability impact. Publicly available exploit code exists (VulnCheck advisory plus a HackMD writeup), which raises practical exploitability above a purely theoretical IDOR. However, there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation; the AT:P requirement and the authenticated precondition mean this favors targeted abuse by someone who already holds an account and can determine or enumerate another user's object path rather than mass, unauthenticated exploitation. Net assessment: a genuine authorization-bypass (IDOR, CWE-639) worth prioritizing for any organization actually running MOVO, but its real-world impact is constrained by the obscurity of the product and the two preconditions (authentication plus a known object path). Missing data to note: EPSS and KEV status are absent from the input - absence is not proof of low risk, but no active-exploitation signal is present.

An attacker holding any valid MOVO account authenticates to the chat-api, then supplies another user's object path to /api/documents/fetch to read that victim's private documents, or to /api/documents/save-blueprint to overwrite the victim's presentation blueprints. A public proof-of-concept and writeup exist, so the technique is documented and repeatable; exploitation is low-complexity but depends on the attacker first learning or guessing the target's object path (the AT:P requirement).