CVE-2026-106677: Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl

Login Request a demo

Unscored severity · published Oct 26, 2026

CVE-2026-106677

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl

New

–

CVSS

0.2%

EPSS

No

On KEV

Description

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 5% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-106677

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-106677

github.com

https://github.com/homestay3/homestay-backend

github.com

https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106677.md