LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST… (CVE-2026-111704)

The vulnerability in LangChat (up to commit 2a6285a) is caused by missing authentication enforcement on REST controllers, specifically because no Sa-Token interceptor is registered. This allows unauthenticated remote attackers to access sensitive API endpoints, including /api/v1/auth/users, enabling them to read plaintext user passwords, obtain LLM provider API keys, create super-admin accounts, and perform unauthorized data modification or deletion. The CVSS 3.1 score is 9.8 (critical), reflecting the high impact on confidentiality, integrity, and availability.

Unauthenticated attackers can fully compromise the affected LangChat system by accessing sensitive user credentials and API keys, escalating privileges to super-admin, and modifying or deleting data. This results in a complete breach of confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected REST endpoints and implement authentication controls such as registering a Sa-Token interceptor to enforce authentication on all API requests.