CVE-2026-119598

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts...

CVE-2026-119598 Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts...

EUVD-2026-113935

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts...

CVE-2026-119598

Miaomiaowu versions prior to 0.9.3 are vulnerable to an insecure direct object reference (IDOR) vulnerability in the /api/user/proxy-provider-configs endpoint. An authenticated user can exploit this by iterating the global auto-increment external_subscription_id parameter to access configurations...