CVE-2026-119664

EUVD-2026-114080
Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/wannabespace/tamery
https://github.com/wannabespace/tamery/blob/v0.32.0/apps/api/orpc/routers/chats-messages/update.ts#L9-L36
https://github.com/wannabespace/tamery/commit/76e75a9569f31405751a63048bae076f500c1c2c
https://github.com/wannabespace/tamery/issues/601
https://hackmd.io/@hieuPenguinnn/conar-broken-ownership-cross-user-write
https://www.vulncheck.com/advisories/tamery-conar-0.26.1-before-0.99.0-authorization-bypass-via-chatsmessages-update