https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-26T04:36:28.030564+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-116017 CVE-2026-116017 — Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint 2026-10-26T04:36:28.032736+00:00

Affected: xinnan-tech xiaozhi-esp32-server

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.