CVE-2026-110611 — REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Auth…
Published: 2026-10-14 · CVSS: 6.0 · CVSS 4.0
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7