---
id: CVE-2026-119664
title: >-
  Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via
  chatsMessages.update
summary: >-
  Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass
  vulnerability in the cloud sync API chatsMessages.update handler, which leaves
  the client-supplied chatId writable. Authenticated Pro subscribers who know
  anot…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: wannabespace
product: tamery
affected:
  - tamery >= 0.26.1 < 0.99.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:34:39.093761Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:34:59.928Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119664'
references:
  - url: 'https://github.com/wannabespace/tamery/issues/601'
  - url: >-
      https://github.com/wannabespace/tamery/commit/76e75a9569f31405751a63048bae076f500c1c2c
  - url: >-
      https://github.com/wannabespace/tamery/blob/v0.32.0/apps/api/orpc/routers/chats-messages/update.ts#L9-L36
  - url: 'https://hackmd.io/@hieuPenguinnn/conar-broken-ownership-cross-user-write'
  - url: 'https://github.com/wannabespace/tamery'
  - url: >-
      https://www.vulncheck.com/advisories/tamery-conar-0.26.1-before-0.99.0-authorization-bypass-via-chatsmessages-update
    label: >-
      VulnCheck Advisory: Tamery (Conar) 0.26.1 before 0.99.0 Authorization
      Bypass via chatsMessages.update
tags:
  - cve.org
  - exploit-available
epss: 0.00295
epssPercentile: 0.22242
ingestedAt: '2026-11-05T16:07:30.298Z'
---

## Overview

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.

## Affected

- `tamery >= 0.26.1 < 0.99.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.