CVE-2026-106677: Homestay3 homestay-backend vulnerability

Published Oct 26, 2026

Updated

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

Affected Software

1 affected component

Homestay3 homestay-backend=0.0.1-SNAPSHOT

Event History

Oct 26, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated user can exploit it if they can supply arbitrary conversation IDs to the affected chat service functionality. The service does not verify that the caller belongs to the requested conversation.

What actions can an attacker perform through the vulnerable functionality?

An attacker can view conversations, read messages, send messages, and mark messages as read in conversations they are not a participant in.

How can I determine whether my deployment is affected?

Check whether you are running Homestay3 homestay-backend version 0.0.1-SNAPSHOT and whether ChatServiceImpl authorizes requests by confirming the caller is a participant in the target conversation. If arbitrary authenticated users can access a conversation by changing its ID, the deployment is affected.

CVE-2026-106677: Homestay3 homestay-backend vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What actions can an attacker perform through the vulnerable functionality?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What actions can an attacker perform through the vulnerable functionality?

How can I determine whether my deployment is affected?