{"id":"CVE-2026-106677","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-106677","generatedAt":"2026-10-27T23:59:05.265Z","title":"An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.","description":"Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.","published":"2026-10-26T17:17:12.000Z","lastModified":"2026-10-26T18:41:21.000Z","status":"Deferred","sourceIdentifier":"cve@mitre.org","cvss":null,"cwe":[],"affected":[],"epss":null,"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"unknown","text":"Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-26T17:17:12.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-26T17:17:11.957Z"},"summary":"New CVE, not yet scored."}],"references":[{"url":"https://github.com/homestay3/homestay-backend","source":"cve@mitre.org"},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106677.md","source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-106677","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}