CVE-2026-119664

Tamery chat-message updates cross account ownership

wannabespace · Tamery / Conar cloud sync

First documented disclosure · Review checkpoint

Summary

A subscriber can insert their message into another user’s AI history.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Researcher performed static source review only, without runtime exploitation or a live victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The update checks the current owner but accepts a replacement parent chat ID.

Conditions required

Authenticated Pro subscriber, an owned message and knowledge of the victim’s chat ID.

Potential impact

Integrity loss in another account’s chat; secret access and code execution are not established.

Affected versions and configurations

VulnCheck: >=0.26.1 and <0.99.0.

Fix and mitigation status

0.99.0 per VulnCheck.

Practical next steps

Update past the affected range; reject ownership-changing fields and validate the destination owner.

Operating lesson

Recheck ownership after every relationship-changing mutation.

Evidence and limits

October 22 public issue precedes October 30 CVE publication. Only the chat-message finding is mapped here; the report’s separate connection-resource issue is not assigned this CVE.

Sources