langchain4j-aideepin versions up to 3.32.0 have an authorization bypass vulnerability in the CharacterMessageController. Authenticated users can exploit missing ownership checks to access other users' message references by supplying another user's message UUID to certain endpoints. This allows unauthorized retrieval of knowledge-base chunks, long-term memory text, and knowledge-graph data.