A missing authentication check in the exportExcel API route lets an attacker send POST requests without credentials and retrieve an XLSX file that contains usernames, email addresses, user prompts, and AI responses. Without authentication, the data is exposed to anyone who can reach the public endpoint, leading to a full disclosure of private conversation content and personally identifying information.

The vulnerability affects the 99AI application from vastxie, specifically versions up to and including 4.3.0. Any deployment of these releases that has the /api/chatLog/exportExcel endpoint exposed to the network is susceptible.

The CVSS score of 8.7 indicates a high severity risk. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication combined with easy request construction means the attack can be performed remotely without special prerequisites. An attacker can manipulate pagination and optional email filtering parameters to retrieve all or a subset of the logs, potentially exposing a large amount of sensitive data.