Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations.
CVSS 4.0MEDIUM 5.3·Network·Low privileges·No interaction·EPSS 0.00347·Published 2026-10-30·Fixed in 0.9.3CWE-639