CVE-2026-79917

Summary

The flaw allows an attacker to create public ChatShareLinks and PublicFileAccess states for a victim's conversation without proper authentication, exposing sensitive information.

Exploitability

Exploitation requires access to a chat token and knowledge of the victim’s chat_id; it is moderately easy given these preconditions.

Blast radius

If exploited, this could lead to unauthorized access to private conversations and files within the enterprise network, impacting data confidentiality significantly.

Prioritized remediation

Implement strict authentication checks for chat_id and application_id in POST /chat/api/{application_id}/chat/{chat_id}/share_chat endpoint.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.