Threats tagged 'ghsa-p9w4-jq2c-hfxp'

JeeSite versions 5.11.0 through 5.19.1 have an insecure direct object reference vulnerability in the AI CMS chat module. This flaw allows authenticated users to access, delete, or append to other users' AI chat conversations by exploiting missing and reversed ownership checks. The vulnerability affects endpoints that handle chat messages and completions, exposing sensitive chat transcripts to unauthorized modification or disclosure.