Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.
Fix
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · wannabespaceNVD modified 2026-10-30 14:16
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/wannabespace/tamery/issues/601 issue-tracking
- https://github.com/wannabespace/tamery/commit/76e75a9569f31405751a63048bae076f500c1c2c patch
- https://github.com/wannabespace/tamery/blob/v0.32.0/apps/api/orpc/routers/chats-messages/update.ts#L9-L36 technical-description
- https://hackmd.io/@hieuPenguinnn/conar-broken-ownership-cross-user-write third-party-advisory
- https://github.com/wannabespace/tamery product
- https://www.vulncheck.com/advisories/tamery-conar-0.26.1-before-0.99.0-authorization-bypass-via-chatsmessages-update third-party-advisory