CVE-2026-111704 Details
Description
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
A missing authentication vulnerability has been identified in LangChat versions through commit 2a6285a. This vulnerability allows unauthenticated remote attackers to access REST API controllers because no Sa-Token interceptor is registered. As a result, attackers can query the user management endpoint to access plaintext passwords, retrieve API keys for LLM providers, create super-admin accounts, and modify or delete various types of data within the application.
To address this vulnerability, register a Sa-Token interceptor in a 'WebMvcConfigurer' to enforce authentication on all routes except for login and logout. Additionally, remove sensitive information such as passwords and API keys from responses by using a response DTO or adjusting the MyBatis-Plus field strategy.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LangChat | <= 2a6285a6b8c51d51cdc599771bb667a30bc03f5c |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |