99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111706 · Microsoft / collected KEV context

cve-program · CVE-2026-111706

• https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor
• https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.controller.ts#L47-L52
• https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts#L104-L155
• https://github.com/vastxie/99AI
• https://www.vulncheck.com/advisories/99ai-through-4.3.0-unauthenticated-information-disclosure-via-chatlog-exportexcel

No related operational record is retained in the current change model.