CVE-2026-110611
CVE-2026-110611 · REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.
CVSS 6.0 · Media · EPSS 0,4%
- Publicación
- Actualización
Productos y versiones afectados
rebuild
- Versiones
- ≥ 0, ≤ 4.5.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/getrebuild-rebuild-aibot-chat-idor
- https://github.com/getrebuild/rebuild/blob/48c6cc42f9c331cc57c057fa9c66d6cbda990131/src/main/java/com/rebuild/web/aibot/AiBot2Controller.java#L151-L203
- https://github.com/getrebuild/rebuild/blob/48c6cc42f9c331cc57c057fa9c66d6cbda990131/src/main/java/com/rebuild/core/aibot2/ChatManager.java#L99-L101
- https://www.vulncheck.com/advisories/rebuild-through-4.5.0-authorization-bypass-via-aibot2-chat-endpoints-chatid
- https://nvd.nist.gov/vuln/detail/CVE-2026-110611