Moyangzhan CVEs and Security Vulnerabilities

CVE-2026-125386

langchain4j-aideepin through 3.32.0 IDOR via /character/message reference endpoints

langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to missing owner checks. Attackers can supply another user's message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints to retrieve knowledge-base chunks, long-term memory text, and knowledge-graph data.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Moyangzhan

Products

Langchain4j-aideepin

CVE-2026-121938

langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs.