CVE-2026-110611
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership.
Published Oct 14, 2026 · updated Oct 14, 2026
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.
Sources
- CVE.orgCVE-2026-110611
Official CVE identifier
cve.org - NIST NVDCVE-2026-110611
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback
nvd.nist.gov