Dashboard / CVE-2026-119048

CVE-2026-119048

LOW
INFO Priority: 0.00 BB Relevance: 45/100
Published: 2026-10-29 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: X
AT: Present
VC: Low
VI: Low
VA: None

Description

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
thinkgem JeeSite 5.11.0

References & Advisories (7)

Bug Bounty Relevance

45 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

2.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

No EPSS data available

Intelligence Sources

mitre ref →
nvd ref →

External Links