VectorStoreChatMemoryAdvisor in VMware Spring AI allows an attacker to inject malicious filter logic through the conversationId parameter, bypassing conversation isolation and extracting chat history, including secrets and credentials, from other users. This flaw is an example of improper access control, enabling cross‑tenant data leakage without authentication.

The vulnerability affects systems that deploy VMware Spring AI with the VectorStoreChatMemoryAdvisor component and accept user‑provided conversation identifiers. No specific version numbers are listed; any application that relies on this advisor to scope chat memories is potentially impacted.

The CVSS score of 5.9 indicates moderate severity, and the absence of an EPSS rating does not provide an estimated exploitation probability. The vulnerability is not currently catalogued in CISA’s KEV list. Based on the description, the likely attack vector is via a network‑based API where an attacker supplies a crafted conversationId to manipulate the filter logic. Successful exploitation could lead to unauthorized disclosure of sensitive user data.