CVE-2026-119664— Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update

Quick assessment

Affected

wannabespace tamery

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tamery（前身为 Conar）0.26.1 至 0.99.0 之前的版本中，云同步 API 的处理器存在授权绕过漏洞，导致客户端提供的可被写入。已知的 Pro 订阅用户若知晓其他用户的聊天 ID，即可将任意内容片段及元数据插入受害者的 AI 聊天历史记录中。

CVSS 4.3 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1557.001 · Name Resolution Poisoning and SMB Relay T1548.001 · Setuid and Setgid

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update

Source: CVE Program / CVE List V5

Vulnerability Description

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
wannabespace	tamery	0.26.1 ~ 0.99.0	-

II. Public POCs for CVE-2026-119664

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119664

请登录查看更多情报信息。

Other References for CVE-2026-119664 (6)

https://github.com/wannabespace/tamery/blob/v0.32.0/apps/api/orpc/routers/chats-messages/update.ts#L9-L36 technical-description
https://github.com/wannabespace/tamery product
https://hackmd.io/@hieuPenguinnn/conar-broken-ownership-cross-user-write third-party-advisory
https://github.com/wannabespace/tamery/commit/76e75a9569f31405751a63048bae076f500c1c2c patch
https://github.com/wannabespace/tamery/issues/601 issue-tracking
https://www.vulncheck.com/advisories/tamery-conar-0.26.1-before-0.99.0-authorization-bypass-via-chatsmessages-update third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119664

IV. Related Vulnerabilities

Same product: tamery

CVE-2026-119663
Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via

Same vendor: wannabespace

CVE-2026-119663
Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via

Same weakness: CWE-639