CVE-2026-119598 Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts...