CVE-2026-119664: Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update
Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tamery (formerly Conar)to a version that resolves this vulnerability.Fixed in 0.99.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Pro subscriber can exploit it. The attacker must know another user's chat ID.
What access does exploitation provide?
An attacker can move messages containing arbitrary parts and metadata into another user's AI chat history. The issue affects integrity; the provided data does not indicate confidentiality or availability impact.
Which versions are affected?
Tamery versions from 0.26.1 up to, but not including, 0.99.0 are affected.