99AI: an unauthenticated export hands over every user's chat log

01What happened

VulnCheck published CVE-2026-111706 for 99AI on October 16, 2026, and the GitHub Advisory Database listed it the same day with a CVSS 4.0 score of 8.7. The finder, who writes as hieuPenguinnn, documented the flaw in a HackMD write-up against version 4.3.0 at a pinned commit, and states the work was a source review with no live requests run. Neither advisory names a fixed release.

02How it works

99AI is built on NestJS, which leaves a route anonymous unless the code attaches a guard to it. The chatLog controller declares POST /api/chatLog/exportExcel with no guard at all, so any caller can set the page, size and optional email fields and receive an xlsx export of stored conversations, narrowed to one victim by supplying that person's email address. The same write-up reports a second problem in GET /api/chatLog/querySingleChat, which checks for a token but not for ownership, so a message can be read by its id.

03Who is affected

Self-hosted 99AI deployments are exposed in every version through 4.3.0, which is the range VulnCheck lists. The project is a multi-user AI platform with chat, model access and an admin panel, so the exported rows carry account emails alongside the text users typed and the answers the models returned. Anyone who can reach the server over the network can call the route, because no account is needed.

04What to do

Put authentication in front of 99AI and block outside access to /api/chatLog/* until a patched release exists, because no advisory names one. Operators who can patch locally can follow the write-up's advice: attach an admin guard to the export route, add an owner check to the single-message lookup, and register a global guard that fails closed with an explicit list of public routes.

Sources 4 links, all fetched

1. 1vulncheck.comVulnCheck Advisory
2. 2hackmd.ioResearcher Write-Up
3. 3github.comGitHub Advisory
4. 4github.comVulnerable Route