{"id":"CVE-2026-116017","summary":"Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint","details":"Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.","modified":"2026-10-25T07:13:45.069795204Z","published":"2026-10-24T11:40:34.247Z","database_specific":{"cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116017.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116017.json"},{"type":"PACKAGE","url":"https://github.com/xinnan-tech/xiaozhi-esp32-server"},{"type":"ARTICLE","url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java#L173-L178"},{"type":"ARTICLE","url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/resources/mapper/device/DeviceAddressBookDao.xml#L5-L10"},{"type":"FIX","url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03"},{"type":"REPORT","url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3459"},{"type":"FIX","url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/pull/3460"},{"type":"ADVISORY","url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/releases/tag/v0.9.8"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/xiaozhi-esp32-server-address-book-idor"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116017"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/xiaozhi-esp32-server-before-0.9.8-idor-via-device-address-book-endpoint"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xinnan-tech/xiaozhi-esp32-server","events":[{"introduced":"0"},{"fixed":"8f2dda09cf18f1c1ece0f906eee4cc2fabb7fb58"},{"fixed":"d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"0.9.8"}]},{"range":[{"fixed":"d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v0.9.8","range":[{"fixed":"8f2dda09cf18f1c1ece0f906eee4cc2fabb7fb58"}],"source":"REFERENCES_TAG"}]}}],"versions":["v0.9.7","v0.9.6","v0.9.5","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.8.11","v0.8.10","v0.8.9","v0.8.8","v0.8.6","v0.8.5","v0.8.3","v0.8.2","v0.8.1","v0.7.6","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.6.3","v0.6.2","v0.6.1","v0.5.8","v0.5.7","v0.5.6","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.3.13","v0.3.12","v0.3.11","v0.3.10","v0.3.9","v0.3.8","v0.3.7","v0.3.6","v0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.2.1","v0.1.18","v0.1.17","v0.1.16","v0.1.15","v0.1.14","v0.1.13","v0.1.12","v0.1.11","v0.1.8","v0.1.10","v0.1.9","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.0.9","v0.0.8","v0.0.7","v0.0.6","v0.0.5","v0.0.4","v0.0.3","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116017.json","vanir_signatures":[{"source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"file":"main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java","function":"getAddressBook"},"deprecated":false,"digest":{"function_hash":"44913963637228578790123289859088098107","length":133},"id":"CVE-2026-116017-0710a570","signature_type":"Function","signature_version":"v1"},{"target":{"file":"main/manager-api/src/main/java/xiaozhi/modules/device/service/DeviceService.java"},"deprecated":false,"digest":{"line_hashes":["328062739289772739876954610726502924974","299429961270117989319309101820150804688","330769756741608193573316444879268166207"],"threshold":0.9},"id":"CVE-2026-116017-1600e0f0","signature_type":"Line","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03"},{"id":"CVE-2026-116017-28ce3836","signature_type":"Line","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/8f2dda09cf18f1c1ece0f906eee4cc2fabb7fb58","target":{"file":"main/manager-api/src/main/java/xiaozhi/common/constant/Constant.java"},"deprecated":false,"digest":{"line_hashes":["330555574255373020993190720495751384450","304683801835181147820942450551299879363","49905374055320430550414360113733884833","213792994974938814723571294747026657020"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"316518363089016064040412400530077535607","length":150},"id":"CVE-2026-116017-339e86e3","signature_type":"Function","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"function":"controller","file":"main/manager-api/src/test/java/xiaozhi/modules/device/controller/DeviceControllerTest.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["136868044364311167918769392826308825605","31486935500204367861141541616138669360","8269812889107629934058998997626535151","196818884389984997498862802078853685826","290545248653177373576401336793338786229","194919604046826833258599081899005333396","312652398894456360122232025496576445613","319736006569731442009277386213239665634","141898437782427212753069496134372926008","205220562539382377144655621088946727411","193879684976148798530231415674188200054","153722854755482773207684407947695546348","73960416288270244006820561262872173393","228508861245132316056135722231050675987","184845939192054379555275920861647953794","216409190071380729350436743230474558373","65490537647081160167983348488110557147","193140730647563008737563705612933902715","183812546911114515864988865103543835847","146438668603342487587331826125161919373","129084890127457679952954876305274876503","63954488932980218736674256092559432291","217764830375560765317260180416347952539","45185557309411521763269778450925667270","52820631963383683095252956443520762406","232159352267659571064881534974982587838","53805459923556691962800458476140485089","56006606264162313600160893630635642693"]},"id":"CVE-2026-116017-39bdbff4","signature_type":"Line","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"file":"main/manager-api/src/test/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImplTest.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"function":"refreshCache","file":"main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java"},"deprecated":false,"digest":{"length":1040,"function_hash":"271099668009618464160896200823706985934"},"id":"CVE-2026-116017-3a175439"},{"source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"file":"main/manager-api/src/test/java/xiaozhi/modules/device/controller/DeviceControllerTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["178905581846851927549920111365032997506","327342259104505920770960616797659846158","156800613003819155593607913980662768612","214735404623464708476448897090997388492","299665922449074948378392257088385478719","79178331520355933833569661320337514588","230112956151116232589527977842882141191","318228382862081738002661210922791053382","63316056106008945165288178068288454369","15342910357790281258620589378979082131","243692939106776702601231257080810116080","40854499699601182659837134237927521456","224291006212648256134242945971200884865","125142501116580226138596809882831628874","88164319793825676022789365579705122669","223403071507946949664348688246791427967","59643663998159486193660164093512618711","103261768327813280331877870302467711076","210174740687491591275434467711901486532","307522943866098818066846958133177876902","251097903308250505106790323092394534649","145068454037823624390780874361984393779","202414561345564940553967845402903992130","314140068231384854428640213659455518697","16243828896698689930941259807625536796","192718703967147404874062518553016395963"]},"id":"CVE-2026-116017-6daa0ca4","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"function":"saveOrUpdate","file":"main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java"},"deprecated":false,"digest":{"length":929,"function_hash":"106613449514842078607884739402448910970"},"id":"CVE-2026-116017-7c33f639","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"file":"main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java","function":"getAddressBookList"},"deprecated":false,"digest":{"function_hash":"247314258616360150111755570346612320346","length":85},"id":"CVE-2026-116017-81b9787c"},{"source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"file":"main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java"},"deprecated":false,"digest":{"line_hashes":["86735885384986005398742846697498975224","94955568237657134076513904905661379240","269487441824463198859494528200176044225","12631786698776718701671811760407550553","28094267342677719618481484460148643529","323538516665628897250455464645742045631","206821250955214843038496050787977740200","98691388849087074264236557271253131911","70603791318684809133827421946844571199","314179844614630270949480102854959370808","318591741346105318284672599071090694219","131156451906833442349882862136126264033","10993608648543087406742211570577774285","58327193059119115190590736292722255759","81760847554355449418969405321784199599","160816749135963424570589222474798292804","51228418843196248285308183835863100059","54960538120317558760458894440714271738","27739200054903020206192798294971072529","99759787867345477505744417343110300195","167971284735990157338350108402269583612","195445680050484467856545570329249852464","311394978066240306216062005820295246396","183405541583062726395717091566119078182","509428888523411158099414253925767211","289756834516831688788524670613348118530","283923522613971123693964485379237059316","303343167374090629100209433177873158593","59275531972098778273852053449200887999","319052729967891577650849132000417788852","140191496430903366343554536612382592181","96865733767485786529509104044735178630","193158792983626326704728506789956034252","157499333441420408027603029831188693689","301447971698855062484988574246472235523","181149818663856253620326552636747244363","201065216257891903249273561139925675788","225073342672045582023807375583778562876","238399235456255207531509567884276605151","114430621661491576558738957594129278659","147750902051770731007752981981726955111","33117276222641985953668280395165811233","175089132680247309150113119046664227510","279758886539549493494852261132711181369","338207625722284004688199593558889483196","219913091410542570595702858829738258970","190794066414586264594401987230784795669","61109285558670167172791789123414816234","106843795681791478436771712435414365149","208644033508040577695432833916790201683","191351836792414689280250571595112794492","39732520236244306901141175233191356684","178886049496232094683468963927988431866","321000510683047606569799447683473003125","249138585016705098177207999011731753196","166825205088960655026109743179750828915","274427346100614941129699916239983702842","329618579639140014710651658812873870792","336609366966905083399641181879593036936","8869558384385161964957442504332373563","65736091548285927117244501079497910137","89116396593851600855288738383575331453","115651010053422422112877230917392435471","321471356308140276770316539175970332467","107552941331642694487753563171629787141","148022729622687737124822364204984556086","115494347478205271502641380221234640085","223041337590146604783602505867689859734","69421797327502516604677015906011940646","6128675838380283188508843432626101290"],"threshold":0.9},"id":"CVE-2026-116017-87c5ec52","signature_type":"Line","signature_version":"v1"},{"target":{"function":"updateFailureIsReturnedToCaller","file":"main/manager-api/src/test/java/xiaozhi/modules/device/controller/DeviceControllerTest.java"},"deprecated":false,"digest":{"function_hash":"281351477364223739315635023710137219064","length":843},"id":"CVE-2026-116017-a57fdb42","signature_type":"Function","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"file":"main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["68351689496135660382845629012153569623","237114352524137077875533829242999730628","155313526261142060542742902712081092911","158583109480634606349917159312891604786","141849963189157170919299281299862370548","43713062950216796499536838070633908032","87162423040614686538035213053103895701","323977275938761060493293741655453560073","302473883602427211948237460321061074344","308418896079490225053221426512202007125","270087894298371499146175025589145147755","234264990138781253716320191459394783005","318070660156159345919848415602996671891","323977275938761060493293741655453560073","302473883602427211948237460321061074344","243654388191563379937992711214699250163"]},"id":"CVE-2026-116017-a5aad8d4"},{"id":"CVE-2026-116017-aa32fe83","signature_type":"Function","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"function":"updatePermission","file":"main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java"},"deprecated":false,"digest":{"length":431,"function_hash":"133904763126566784437065312906389074331"}},{"deprecated":false,"digest":{"line_hashes":["42373829340826942026663022447472440397","317802710395643434040976085893320690752","153960709898377817045559922118518700099","235165426073431547455670537151792560427","118405062804115067368682639198275375598","264470407050919655457648897837624017193","248556926017981661308507848835956229924"],"threshold":0.9},"id":"CVE-2026-116017-b1b90218","signature_type":"Line","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"file":"main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceServiceImpl.java"}},{"target":{"file":"main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java","function":"callByNickname"},"deprecated":false,"digest":{"length":1058,"function_hash":"107930966951836931277158454245957032789"},"id":"CVE-2026-116017-bdccb76b","signature_type":"Function","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03"},{"source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"file":"main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java","function":"updateAlias"},"deprecated":false,"digest":{"function_hash":"286311434763626296563988942212385053179","length":431},"id":"CVE-2026-116017-bebe7a9d","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-116017-c6a3f0f9","signature_type":"Function","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"file":"main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceServiceImpl.java","function":"unbindDevice"},"deprecated":false,"digest":{"length":500,"function_hash":"229042274786901162976297467488911666756"}},{"deprecated":false,"digest":{"function_hash":"192377624227110119031835493327557478268","length":879},"id":"CVE-2026-116017-d6e9b948","signature_type":"Function","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"function":"newEntryUsesTheDedicatedAddressBookInsertMapping","file":"main/manager-api/src/test/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImplTest.java"}},{"deprecated":false,"digest":{"function_hash":"86379348675481802818834322260260359502","length":210},"id":"CVE-2026-116017-f13aa816","signature_type":"Function","signature_version":"v1","source":"https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03","target":{"file":"main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java","function":"formatMacAsDeviceName"}}],"vanir_signatures_modified":"2026-10-25T07:13:45Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}