{"data":{"id":"85fb6ed8-6d58-485c-bf9e-22605969ddba","title":"CVE-2026-125386: langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in…","summary":"langchain4j-aideepin through 3.32.0 contains an insecure direct object reference flaw in CharacterMessageController. Authenticated users can access other users' message references because owner checks are missing. Supplying another user's message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints returns knowledge-base chunks, long-term memory text, and knowledge-graph data.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-125386","publishedAt":"2026-11-10T00:17:11.993Z","cveId":"CVE-2026-125386","cweIds":["CWE-639"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["langchain4j-aideepin"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchain4j-aideepin insecure direct object reference in message endpoints","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-10T06:09:39.897Z","kevDateAdded":null,"advisoryAliases":["GHSA-58f4-85vm-hv79"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-10T06:09:44.085Z","patchAvailable":null,"disclosureDate":"2026-11-10T00:17:11.993Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}