langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid.
CVSS 4.0MEDIUM 6.0·Network·Low privileges·No interaction·EPSS 0.00391·Published 2026-11-04·Fixed in 3.31.0CWE-639