Description

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.

Related CPE's

Could not find any relations

References

https://github.com/wannabespace/tamery

https://github.com/wannabespace/tamery/blob/v0.32.0/apps/api/orpc/routers/chats-messages/update.ts#L9-L36

https://github.com/wannabespace/tamery/commit/76e75a9569f31405751a63048bae076f500c1c2c

https://github.com/wannabespace/tamery/issues/601

https://hackmd.io/@hieuPenguinnn/conar-broken-ownership-cross-user-write

https://www.vulncheck.com/advisories/tamery-conar-0.26.1-before-0.99.0-authorization-bypass-via-chatsmessages-update

Weaknesses

[email protected]

Primary
CWE-639

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.3 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-30T15:16:50.873Z

5 hours ago

Last modified

2026-10-30T19:23:25.493Z

1 hour ago