Tamery CVEs and Security Vulnerabilities

CVE-2026-119664

Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wannabespace

Products

Tamery

CVE-2026-119663

Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.