TelegAI Insecure Direct Object Reference Vulnerability Allowing Conversation Tampering and XSS Injection

A vulnerability has been identified in TelegAI's chat component, through version 2025-05-26, involving Insecure Direct Object Reference (IDOR). This vulnerability allows an attacker to manipulate conversations of other users. Furthermore, it enables the injection of malicious content and XSS payloads, which could be exploited for phishing attacks, user spoofing, and account hijacking via XSS.

Impact

Exploitation of this vulnerability could lead to unauthorized manipulation of user conversations, injection of malicious content and XSS payloads, and potential phishing attacks, user spoofing, and account hijacking via XSS.

Reproduction

The vulnerability can be reproduced by changing the 'profile_id' field in the conversation API request. This field is used for authorization and is disclosed in shared conversations, making it accessible for exploitation. Once the 'profile_id' is altered to that of a victim, the attacker can intercept and modify the victim's chat.