CVE-2026-111699 Details

An authentication bypass vulnerability has been identified in Niefy wx-api versions through 0.8.2. This vulnerability allows unauthenticated attackers to impersonate WeChat fans by sending a raw openid cookie to controllers that manage fan data. Exploiting this flaw, attackers can access personal information of the targeted fan, including nickname, phone number, unionid, and tags, through the /wxUser/getUserInfo and /wxUserTags endpoints. Additionally, the vulnerability allows for the manipulation of fan tags by adding or removing them.

To address this vulnerability, it is recommended to implement proper authentication checks for the fan endpoints that read by openid. This includes verifying the openidToken cookie, which is intended to authenticate fans but is not currently checked. Additionally, the appid owner check should be applied to all management detail endpoints to ensure that data access is properly scoped to the authenticated user's account.