xiaozhi-esp32-server vulnerabilities

CVEs whose affected-version data names the xiaozhi-esp32-server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-116017Medium· 4.3

6d ago

Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers …

▾ Sunlitxinnan-tech · xiaozhi-esp32-serverEPSS 0.23%via CVEORG