UNKNOWN NVD

CVE-2026-106677

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and m

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

References

https://github.com/homestay3/homestay-backend
https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106677.md

Published: 2026-10-26 · Source: NVD · Feed updated: 2026-10-26

This unknown severity vulnerability was published on 2026-10-26 via NVD.

vulnfeed aggregates 18200 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.