{"id":"CVE-2026-116017","revision":"1dc0f8bff0ba4c4595b86d42f3ecd7e7","records":[{"revision":"1dc0f8bff0ba4c4595b86d42f3ecd7e7","observedAt":"2026-10-24T13:07:03.442+00:00","statement":{"source":"cve-program","id":"CVE-2026-116017","aliases":[],"title":"Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint","description":"Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.","state":0,"publishedAt":"2026-10-24T11:40:34.247+00:00","modifiedAt":"2026-10-24T11:40:34.247+00:00","affected":[{"ecosystem":"Vendor product","name":"xiaozhi-esp32-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"xinnan-tech\",\n                    \"product\": \"xiaozhi-esp32-server\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"0.9.8\",\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:github/xinnan-tech/xiaozhi-esp32-server\",\n                    \"repo\": \"https://github.com/xinnan-tech/xiaozhi-esp32-server\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3459","https://github.com/xinnan-tech/xiaozhi-esp32-server/pull/3460","https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","https://github.com/xinnan-tech/xiaozhi-esp32-server/releases/tag/v0.9.8","https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java#L173-L178","https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/resources/mapper/device/DeviceAddressBookDao.xml#L5-L10","https://hackmd.io/@hieuPenguinnn/xiaozhi-esp32-server-address-book-idor","https://www.vulncheck.com/advisories/xiaozhi-esp32-server-before-0.9.8-idor-via-device-address-book-endpoint"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116017","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-116017","identifiers":["CVE-2026-116017"]},"retained":false,"historicalAffected":[]}],"coverage":[]}