CVE-2026-116017: Authorization Bypass Through User-Controlled Key in xinnan-tech xiaozhi-esp32-server
Affects xinnan-tech xiaozhi-esp32-serverSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NWhat to do
AI-suggested
No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the DeviceController.getAddressBook API to authorized users only and monitor for suspicious access patterns.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| xinnan-techxiaozhi-esp32-server | Affected
| Fixed in
|
GitHub Actionsxiaozhi-esp32-serverpkg:github/xiaozhi-esp32-serverOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
Xiaozhi-esp32-server versions before 0.9.8 have an insecure direct object reference vulnerability in the DeviceController.getAddressBook API. Authenticated users, including those with self-registered accounts, can access other users' device address books by specifying another user's device MAC address. This exposes contact MACs, aliases, call permissions, and owner user IDs.
References
- github.com/xinnan-tech/xiaozhi-esp32-server/issues/3459 (opens in a new tab)
- github.com/xinnan-tech/xiaozhi-esp32-server/pull/3460 (opens in a new tab)
- github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03 (opens in a new tab)
- github.com/xinnan-tech/xiaozhi-esp32-server/releases/tag/v0.9.8 (opens in a new tab)
- github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java (opens in a new tab)
- github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/resources/mapper/device/DeviceAddressBookDao.xml (opens in a new tab)
- hackmd.io/@hieuPenguinnn/xiaozhi-esp32-server-address-book-idor (opens in a new tab)
- vulncheck.com/advisories/xiaozhi-esp32-server-before-0.9.8-idor-via-device-address-book-endpoint (opens in a new tab)