Authorization bypass in Xiaozhi-esp32-server exposes device address books
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference in the manager-api DeviceController.getAddressBook handler. An authenticated user, including a self-registered account, can request the address book of another user's device by its MAC address and read contact MACs, aliases, call permissions and owner user IDs. The flaw is an authorization bypass through a user-controlled key (CWE-639).
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| xinnan-tech | xiaozhi-esp32-server | before 0.9.8 | 0.9.8 | Patch available | CNA |
- xiaozhi-esp32-server Vendorxinnan-tech Affected before 0.9.8 Fixed in 0.9.8 Patch available CNA
Remediation
Upgrade xiaozhi-esp32-server to version 0.9.8 or later, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA xiaozhi-esp32-server (xinnan-tech) Fixed in 0.9.8
Timeline
- 2026-10-24 Threatist record created from CVE-2026-116017
- 2026-10-24 Alias added: GHSA-2hv3-q586-pf3c
- 2026-10-29 CISA SSVC decision points changed
References
Patch 2
Other 4
- https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3459
- xiaozhi-esp32-server v0.9.8 Release Notes
- https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java#L173-L178
- https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/resources/mapper/device/DeviceAddressBookDao.xml#L5-L10
More xinnan-tech vulnerabilities
- TI-2026-83178 Authentication bypass in xiaozhi-esp32-server via Device-ID spoofing CVSS 4.0MEDIUM 6.3
Sources
- CVE-2026-116017 · CVE Program
- CVE-2026-116017 · NVD
- FIRST EPSS
- GHSA-2hv3-q586-pf3c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences