Threats tagged 'ghsa-j5gc-wvrm-78hc'

An insecure direct object reference (IDOR) vulnerability exists in langchain4j-aideepin versions before 3.31.0. Authenticated users can access other users' character-chat conversations by supplying the target user's character UUID. The vulnerability arises because the CharacterService.detail endpoint does not perform ownership checks on GET /character/{uuid} requests, exposing sensitive conversation data including questions, AI responses, and media URLs.