CVE-2026-3693 Details

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in Shy2593666979 AgentChat versions through 2.3.0. This vulnerability exists in the User Endpoint, specifically within the 'get_user_info' and 'update_user_info' functions of the file '/src/backend/agentchat/api/v1/user.py'. The issue arises because the 'user_id' parameter is accepted directly from user input without proper authorization checks, allowing unauthenticated attackers to access or modify sensitive user information remotely.

Implement proper authorization checks to ensure users can only access or modify their own information. Consider retrieving the user ID from the authenticated session or token instead of accepting it as a parameter. Applying role-based access control (RBAC) to restrict access to user data and logging all user information access and modification attempts for security auditing are also recommended.