CVE-2026-3693
A flaw has been found in Shy2593666979 AgentChat up to 2.3.0. This issue affects the function get_user_info/update_user_info of the file /src/backend/agentchat/api/v1/user.py of the component User Endpoint. This manipulation of the argument user_id causes improper control of resource identifiers. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.40%
- CWE
- CWE-99
- Published
- 2026-03-08
- Last modified
- 2026-03-16
Affected products
- Shy2593666979 AgentChat
- Shy2593666979 AgentChat
- Shy2593666979 AgentChat
- Shy2593666979 AgentChat
Weakness type
Related vulnerabilities
- CVE-2026-81524 — Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
- CVE-2026-81521 — Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver
- CVE-2026-62910 — Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-15186 — macrozheng mall Portal Endpoint create resource injection
- CVE-2026-13493 — AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection
- CVE-2026-12207 — medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection
- CVE-2026-10624 — SourceCodester Human Resource Management Employee View detailview.php resource injection
- CVE-2026-10299 — code-projects Online Hospital Management System viewdoctortimings.php resource injection