CVE-2026-119664
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.
Risk Assessment
An authenticated Pro subscriber can inject messages into another user's AI chat history, compromising data integrity and confidentiality and the victim's privacy.
Recommendation
Upgrade Tamery to version 0.99.0 or later. Until then, restrict trust in client-supplied chatId and monitor for unusual message update operations.
Other vulnerabilities in Tamery
Original NVD description (English source)
Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS