The vulnerability is an insecure direct object reference flaw that enables unauthenticated attackers to read other users’ chat messages in 99AI versions up to and including 4.3.0. Because the querySingleChat endpoint does not validate that the requesting user owns the chat being queried, sensitive chat content and task data can be exposed. The problem is a classic IDOR weakness (CWE‑639).

The affected product is 99AI provided by vastxie, affecting all releases up to and including version 4.3.0.

The CVSS score of 6.9 indicates a medium severity data confidentiality issue. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can acquire a visitor JWT by sending a fingerprint header, after which they can iterate sequential chatId values to enumerate and retrieve other users’ messages through the API. The lack of authentication requirements for the endpoint means the attack is possible from any network location without privileges, so the overall risk of data leakage remains moderate but significant.