A flaw in the AgentChat application allows a remote attacker to manipulate the user_id argument of the get_user_info and update_user_info functions in the user.py module, leading to improper control of internal resource identifiers. This flaw can be used to access or modify data belonging to other users or system components without proper authorization. The vulnerability is identified as a Resource Identifier Injection weakness.

The affected product is Shy2593666979 AgentChat, specifically the User Endpoint component in the backend API, for all versions up to and including 2.3.0. No newer versions are listed as affected.

The CVSS score of 6.9 indicates a moderate severity, but the presence of a published exploit and the indication that the attack can be initiated remotely raise the practical risk. The EPSS score of < 1% suggests a low probability of widespread automated exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is through the exposed API endpoint, where an attacker can supply a crafted user_id to gain unintended access or modify resources. Due to the lack of a vendor response, the risk remains high until a patch or mitigations are applied.