CVE-2026-111699

MediumCVSS 4.8/10Last modified Oct 21, 2026

Description

Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2026
Last modified
Oct 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-11178.2A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive SCVE-2026-111708.1Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level prCVE-2026-1117007.1WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause texCVE-2026-1117017.0OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private buckeCVE-2026-1117027.5ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other usCVE-2026-1117036.3yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other useCVE-2026-1117049.8LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST CVE-2026-1117054.3Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other membCVE-2026-1117067.599AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated atCVE-2026-1117075.399AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chaCVE-2026-1117089.8WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-regCVE-2026-1117095.4WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to ac
CVE-2026-111699: Medium severity, CVSS 4.8 | Vulnix