What is GHSA-3m4r-974p-rpwj?

GHSA-3m4r-974p-rpwj is a security advisory published by GitHub Security Advisories with High severity. Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated...

Which CVE IDs does GHSA-3m4r-974p-rpwj cover?

GHSA-3m4r-974p-rpwj covers the following CVE IDs: CVE-2026-106677. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3m4r-974p-rpwj?

GHSA-3m4r-974p-rpwj has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-3m4r-974p-rpwjHighCVSS 7.1

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated...

Vendor

GitHub Security Advisories

Published

October 26, 2026

Last Modified

November 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-106677 →

📋 Description

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-106677
https://github.com/homestay3/homestay-backend
https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106677.md
https://github.com/advisories/GHSA-3m4r-974p-rpwj