The vulnerability arises from a missing Sa‑Token interceptor in the REST API controllers, which enables unauthenticated callers to access endpoints such as /api/v1/auth/users. Attackers can read plaintext passwords, retrieve LLM provider API keys, create super‑admin accounts, and modify or delete arbitrary data. The flaw is a classic missing authentication issue classified as CWE‑306, giving attackers full confidentiality, integrity, and availability compromise.

Present in deployments of LangChat built from the commit 2a6285a and later that have not added explicit authentication to the REST controllers. The affected product is LangChat provided by the vendor LangChat; no specific version range is enumerated, so any instance using the vulnerable code path is at risk.

The CVSS score of 9.3 places this vulnerability in the critical range, indicating a low mitigability bar. No EPSS data is available, but the remote nature of the flaw suggests high exploitation potential. It is not yet listed in the CISA KEV catalogue. From the description, the likely attack vector is a simple unauthenticated HTTP POST or GET to the exposed REST endpoints.