CVE-2026-116017

MediumCVSS 4.3

Published: 24/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 24/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.

Risk Assessment

An authenticated user can access other users' device address books, disclosing contact MACs, aliases, call permissions, and owner user IDs. This may breach privacy and enable further social engineering attacks.

Recommendation

Update Xiaozhi-esp32-server to version 0.9.8 or later. Until then, consider restricting self-registration of accounts.

Other vulnerabilities in Xiaozhi-esp32-server

CVE-2026-119703Medium
xiaozhi-esp32-server through 0.9.8 contains an authentication bypass in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. An attacker supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio and read that device's conversation context.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS