7 matches found
CVE-2026-106677
Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant...
EUVD-2026-110020
Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant...
Homestay3 homestay-backend security vulnerability
The Homestay3 homestay-backend version 0.0.1-SNAPSHOT contains a security vulnerability. This vulnerability arises because ChatServiceImpl fails to verify whether callers are session participants; it results in an insecure direct object reference IDOR. This may allow authenticated users to view,...
CVE-2026-106677
Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant...
CVE-2026-106677
Homestay3 homestay-backend version 0.0.1-SNAPSHOT is vulnerable to an Insecure Direct Object Reference (IDOR) in the ChatServiceImpl component. The root cause is a failure to verify that the authenticated caller is an actual participant of a conversation. Consequently, an authenticated user can v...
PT-2026-123424
Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant...
CVE-2026-106677
Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant...