CVE-2026-121938

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/uuid, which CharacterService.detail resolves...

CVE-2026-121938

Versions of langchain4j-aideepin before 3.31.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists in CharacterService.detail , which fails to perform an ownership check when resolving the GET /character/{uuid} endpoint. This allows authenticated users to a...

CVE-2026-121938 langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/uuid, which CharacterService.detail resolves...

EUVD-2026-116895

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/uuid, which CharacterService.detail resolves...

PT-2026-136958

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/uuid, which CharacterService.detail resolves...

CVE-2026-121938: moyangzhan langchain4j-aideepin: langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated…

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/uuid, which CharacterService.detail resolves...