What happened
CVE-2026-111706 (CVSS 7.5, CWE-306) verified via NVD REST API (published 2026-10-16 by VulnCheck): the exportExcel chat-log route lacks any authentication, so any remote attacker can download the full conversation history of all platform users without credentials.
Why it matters
For an AI chat product, the chat log is the crown jewel — every user's prompts and the model's responses (frequently containing proprietary or personal content pasted into the LLM). An unauthenticated bulk export turns that into a firehose of sensitive data exfiltration and is trivially automatable.
Attack vector
Unauthenticated POST to /api/chatLog/exportExcel with controlled page/size/email parameters downloads all users' chat logs including the prompts users sent to the LLM and the AI's answers.
Affected systems
99AI ≤ 4.3.0 (vastxie/99AI)
Mitigation
Upgrade beyond 4.3.0; restrict access to the chat-log export route until then. See VulnCheck advisory and chatLog controller reference.