Dashboard / CVE-2026-106677

CVE-2026-106677

HIGH
MEDIUM Priority: 0.02 BB Relevance: 64/100
Published: 2026-10-26 Modified: 2026-11-02 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: Low
A: None

Description

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
n/a n/a n/a

References & Advisories (2)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS — Exploitation Probability

0.22%
Raw Score 0.002190
Percentile 12.6%
Date 2026-11-04

EPSS Trend

2026-11-04
0.00219
2026-11-03
0.00219
2026-11-02
0.00156
2026-11-01
0.00156
2026-10-31
0.00156
2026-10-30
0.00156
2026-10-29
0.00156
2026-10-28
0.00156

Intelligence Sources

mitre ref →
nvd ref →

External Links