Xiaozhi-esp32-server prior to version 0.9.8 contains an insecure direct object reference in the DeviceController.getAddressBook handler, allowing authenticated users to request device address books for any device MAC address. This flaw lets attackers read another user’s device contact MACs, aliases, call permissions, and owner user IDs, resulting in sensitive data disclosure. The weakness is a classic example of CWE‑639, where object identifiers are exposed without proper authorization checks.

The vulnerability affects the xinnan-tech Xiaozhi‑esp32‑server product, specifically all releases before version 0.9.8. Users running these versions should check the release notes and upgrade to the patched version to eliminate the risk.

The CVSS score of 5.3 indicates a moderate severity, but the lack of an EPSS score and absence from the CISA KEV catalog suggest it is not currently a high-priority exploit. Attackers require a valid authenticated account, either normal or self‑registered, and must know or guess another user’s device MAC address to trigger the API call. The vulnerability facilitates data leakage but does not grant code execution or privilege escalation, making the risk moderate under typical deployment scenarios.