CVE-2026-111706: 99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker who can reach the affected application's API can exploit it. No account, credentials, or user interaction are required.
What data can be exposed?
The export endpoint can produce XLSX files containing users' usernames, email addresses, prompts, and AI-generated answers. The issue can expose chat logs for all users.
Can an attacker target specific records or retrieve data in bulk?
Yes. Requests to the endpoint accept controlled page and size values, enabling paginated export requests, and may include an optional email field. This allows an attacker to retrieve exported chat-log data without authentication.
How can I determine whether an instance is affected?
An instance is affected if it runs 99AI version 4.3.0 or earlier and exposes the POST /api/chatLog/exportExcel route without authentication. A successful unauthenticated request that returns an XLSX export indicates exposure.