langchain4j-aideepin versions before 3.31.0 have an authorization bypass vulnerability allowing authenticated users to access other users' character-chat conversations by specifying their character UUID. This flaw occurs because the CharacterService.detail endpoint does not verify ownership before returning sensitive data such as questions, AI responses, and media URLs.