CVE-2026-111704: LangChat through commit 2a6285a Missing Authentication on REST API Controllers
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker able to reach the LangChat REST API can exploit it without authentication, privileges, or user interaction.
What information and actions are exposed?
Attackers can query /api/v1/auth/users to obtain plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
Are deployments affected by default?
The affected code does not register a Sa-Token interceptor, leaving REST API controllers without authentication enforcement.
How can defenders check for exposure?
Determine whether the deployment is running LangChat at or through commit 2a6285a and whether its REST API is reachable. A request to /api/v1/auth/users succeeding without authentication indicates exposure.