CVE-2026-125386: langchain4j-aideepin IDOR vulnerability in CharacterMessageController

# CVE-2026-125386: langchain4j-aideepin IDOR vulnerability in CharacterMessageController

https://gcdradar.vercel.app/incidents/cve-2026-125386-langchain4j-aideepin-idor-vulnerability-in-c · AIR-2026-1848 · closed 2026-11-10

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Disclosed vulnerability rated medium severity with no fix stated in source
- Fix status: Fix status unknown
- First reported: 2026-11-10
- AI role: Attack on AI
- Products: langchain4j-aideepin
- CVE ids: CVE-2026-125386
- CVSS: 6

## Summary

An insecure direct object reference flaw in langchain4j-aideepin up to version 3.32.0 allows authenticated users to access other users' message references due to missing ownership checks. Attackers can supply arbitrary message UUIDs to retrieve sensitive knowledge-base and memory data.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Affected and fixed versions

- Affected: langchain4j-aideepin <= 3.32.0

## Latest updates

- 2026-11-10: CVE-2026-125386: langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that… (https://nvd.nist.gov/vuln/detail/CVE-2026-125386)

## Sources

- 2026-11-10 NVD: CVE-2026-125386: langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that… https://nvd.nist.gov/vuln/detail/CVE-2026-125386

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.