JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-119048 · Microsoft / collected KEV context

cve-program · CVE-2026-119048

• https://github.com/thinkgem/jeesite5/issues/43
• https://github.com/thinkgem/jeesite5
• https://github.com/thinkgem/jeesite5/commit/cbc5ba7a37fd93f38c46ef656bd31442fe6f8015
• https://github.com/thinkgem/jeesite5/blob/5b5e2cf0adc45a1abe33d0f4ca149590d149b82d/modules/ai/ai-cms/src/main/java/com/jeesite/modules/ai/cms/service/CacheChatMemoryRepository.java#L59-L62
• https://github.com/thinkgem/jeesite5/blob/5b5e2cf0adc45a1abe33d0f4ca149590d149b82d/modules/ai/ai-cms/src/main/java/com/jeesite/modules/ai/cms/service/AiCmsChatService.java#L111-L116
• https://hackmd.io/@hieund/jeesite5-ai-cms-chat-conversation-idor
• https://www.vulncheck.com/advisories/jeesite-5.11.0-through-5.19.1-idor-in-ai-cms-chat-module

• JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module · Newly collected advisory · 29 Oct 2026