CVE-2026-119048
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
JeeSite versions 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. An attacker knowing a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.
Risk Assessment
Private user conversations may be disclosed, deleted, or modified, breaching confidentiality and integrity. The risk affects JeeSite deployments with the AI chat module.
Recommendation
Update JeeSite to a version later than 5.19.1. Until then, restrict access to the AI chat module and verify conversation ownership checks.
Other vulnerabilities in JeeSite
See all- CVE-2026-36762High
JeeSite version 5.15.1 contains a vulnerability in the fileEntityId parameter in the /a/file/upload endpoint, allowing authenticated attackers with file upload permissions to perform a path traversal attack and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.
- CVE-2023-38991Medium
An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator.
- CVE-2023-38988Medium
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
Original NVD description (English source)
JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS