Description
A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended.
Published: 2026-11-06
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Authorization bypass leading to unauthorized billing
Action: Patch
AI Analysis

Impact

A remote attacker can manipulate a function in the file voice_ws_handler.go of the STT Billing component, causing the system to enforce a behavioral workflow that may bypass normal authorization controls. The flaw is characterized by the weaknesses identified as CWE-840 and CWE-841. The vulnerability could allow the attacker to trigger charging operations without proper permission, potentially leading to fraudulent billing or financial loss. The vulnerability is not limited to local execution and may be exploited over the network.

Affected Systems

The affected vendor is chenyme, with the product grok2api. Versions up to and including 3.1.6 are vulnerable; upgrading to version 3.1.7 applies the necessary fix.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and no EPSS data are currently available. The issue is not listed in the CISA KEV catalog, suggesting it has not been widely exploited publicly. Based on the description, the attack vector is likely remote network access to the STT Billing API, and an attacker would need to craft input that triggers the problematic behavior in voice_ws_handler.go.

Generated by OpenCVE AI on November 6, 2026 at 22:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to grok2api version 3.1.7, which includes the patch identified by commit 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4.
  • Restrict external access to the STT Billing endpoint, allowing only trusted IP ranges or authenticated clients until the patch is fully deployed.
  • Continuously monitor billing logs and access audit trails for anomalous requests that could indicate exploitation attempts.

Generated by OpenCVE AI on November 6, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended.
Title chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow
First Time appeared Chenyme
Chenyme grok2api
Weaknesses CWE-840
CWE-841
CPEs cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*
Vendors & Products Chenyme
Chenyme grok2api
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Chenyme Grok2api
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-06T21:15:17.807Z

Reserved: 2026-11-06T14:44:36.840Z

Link: CVE-2026-123788

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-06T22:17:50.683

Modified: 2026-11-06T22:17:50.850

Link: CVE-2026-123788

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T23:00:11Z

Weaknesses