CVE-2026-108110 — MOVO through 0.2.3 Authorization Bypass via Document Endpoints
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by sup…
Published: 2026-10-09 · CVSS: 7.6 · CVSS 4.0
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or /api/documents/save-blueprint to read private documents and overwrite presentation blueprints.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7