VulnerabilityDeferred

CVE-2026-106677

An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

UnscoredEPSS —

Does this matter?

Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.

Description

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

CVSS: Not yet scored
EPSS: No score yet
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Source: cve@mitre.org

References

https://github.com/homestay3/homestay-backend
https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106677.md

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.