CVE-2026-116017: Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint
Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user, including a user with a normal or self-registered account, can exploit it. No elevated privileges or user interaction are required.
What information can be exposed?
An attacker can retrieve another user's device address book, including contact MAC addresses, aliases, call permissions, and owner user IDs.
What must an attacker know to access another user's address book?
The attacker needs the target device's MAC address and can submit it to the /device/address-book/{macAddress} endpoint.
Which versions are affected?
Xiaozhi-esp32-server versions before 0.9.8 are affected.