MOVO version 0.2.3 contains an authorization bypass vulnerability in its chat‑api document endpoints that permits any authenticated user to supply arbitrary file paths and read or overwrite another user’s stored objects. The flaw allows the attacker to retrieve private documents through the /api/documents/fetch endpoint and to replace presentation blueprints via /api/documents/save-blueprint, thereby compromising confidentiality and integrity for target users.

The vulnerability affects the MOVO application from himovo, specifically any installation running version 0.2.3 or earlier. Users with valid credentials to the chat‑api are susceptible; no privileged or administrative privileges are required to exploit the flaw.

The CVSS score of 7.6 indicates a high severity. While the EPSS score is unavailable, the lack of listing in the KEV catalog suggests no current widespread exploitation, yet the impact is significant if an attacker identifies the object path of a victim. The exploit requires authentication, hence it is limited to users who can log in, but it provides full read and partial overwrite capabilities on other users’ data.