Medium 4.3Published Oct 24, 2026

CVE-2026-116017Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint

Updated under an hour ago (Oct 27, 2026, 2:50 PM ET)

Does this affect you?

It affects xinnan-tech xiaozhi-esp32-server. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for xinnan-tech xiaozhi-esp32-server

Exploited in the last 30 days

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.

CVSS: 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-639
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 24, 2026
First seen by InfoSec Signals: Oct 24, 2026

Affected products

Affected products

xinnan-tech xiaozhi-esp32-server xinnan_tech:xiaozhi_esp32_server (from the name)	before 0.9.8	CNA record

References

References

https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3459	issue-tracking
https://github.com/xinnan-tech/xiaozhi-esp32-server/pull/3460	patch, issue-tracking
https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03	patch
https://github.com/xinnan-tech/xiaozhi-esp32-server/releases/tag/v0.9.8	release-notes
https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java#L173-L178	technical-description
https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/resources/mapper/device/DeviceAddressBookDao.xml#L5-L10	technical-description
https://hackmd.io/@hieuPenguinnn/xiaozhi-esp32-server-address-book-idor	third-party-advisory
https://www.vulncheck.com/advisories/xiaozhi-esp32-server-before-0.9.8-idor-via-device-address-book-endpoint	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.