CVE-2026-111630 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in the abp-next-admin application, specifically in versions 10.2.0 through 10.6.0, within the LINGYUN.Abp.AIManagement module. This vulnerability enables authenticated users to access other users' AI chat conversations by providing the corresponding ConversationId. Attackers with the Chat permission can exploit this by calling the ChatAppService.GetListAsync or SendMessageAsync methods with a victim's ConversationId GUID. This allows them to read chat messages and inject their own messages into the conversation.

The vulnerability can be addressed by adding owner checks to the chat service methods that read and write messages, ensuring that users can only access their own conversations. This can be done by verifying the ConversationId ownership before processing requests and by enforcing ownership checks in the ConversationStore.