---
id: CVE-2026-106677
title: Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl
summary: >-
  Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl.
  An authenticated user can view conversations, read messages, send messages,
  and mark messages as read for arbitrary conversation ids because the service
  does …
severity: none
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T16:37:22.488Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106677'
references:
  - url: 'https://github.com/homestay3/homestay-backend'
  - url: 'https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106677.md'
tags:
  - cve.org
ingestedAt: '2026-10-26T17:33:33.078Z'
epss: 0.00156
epssPercentile: 0.04671
---

## Overview

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.