CVE-2026-111704
CRITICAL
9,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
CRITICAL
9,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0051
Percentile
0,4th
Updated
EPSS Score Trend (Last 3 Days)
306
Missing Authentication for Critical Function
DraftCommon Consequences
Security Scopes Affected:
Access Control
Other
Potential Impacts:
Gain Privileges Or Assume Identity
Varies By Context
Applicable Platforms
Technologies:
Cloud Computing, ICS/OT
https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03…
https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03…
https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03…
https://hackmd.io/@hieuPenguinnn/langchat-missing-global-auth-credential-exposu…
https://www.vulncheck.com/advisories/langchat-through-commit-2a6285a-missing-au…