Threats affecting pkg:github/JeeSite

JeeSite versions 5.11.0 through 5.19.1 have an insecure direct object reference vulnerability in the AI CMS chat module. Authenticated users can access, delete, or append to other users' AI chat conversations by exploiting missing and reversed ownership checks when calling certain chat-related endpoints. The vulnerability requires knowledge or derivation of a victim's conversation ID. The CVSS score is low, reflecting the need for authentication and high attack complexity.