CVE-2026-116017

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-116017
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116017.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-116017
Published
2026-10-24T11:40:34Z
Modified
2026-10-25T07:13:45Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint
Details

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116017.json"
}
References

Affected packages

Git / github.com/xinnan-tech/xiaozhi-esp32-server

Affected ranges

Type
GIT
Repo
https://github.com/xinnan-tech/xiaozhi-esp32-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8f2dda09cf18f1c1ece0f906eee4cc2fabb7fb58
Fixed
d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.9.8"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.9.8",
            "range": [
                {
                    "fixed": "8f2dda09cf18f1c1ece0f906eee4cc2fabb7fb58"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.1.1
v0.1.10
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.2.1
v0.3.1
v0.3.10
v0.3.11
v0.3.12
v0.3.13
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.6.1
v0.6.2
v0.6.3
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.6
v0.8.1
v0.8.10
v0.8.11
v0.8.2
v0.8.3
v0.8.5
v0.8.6
v0.8.8
v0.8.9
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116017.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "44913963637228578790123289859088098107",
            "length": 133
        },
        "id": "CVE-2026-116017-0710a570",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java",
            "function": "getAddressBook"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "328062739289772739876954610726502924974",
                "299429961270117989319309101820150804688",
                "330769756741608193573316444879268166207"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-116017-1600e0f0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/service/DeviceService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "330555574255373020993190720495751384450",
                "304683801835181147820942450551299879363",
                "49905374055320430550414360113733884833",
                "213792994974938814723571294747026657020"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-116017-28ce3836",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/8f2dda09cf18f1c1ece0f906eee4cc2fabb7fb58",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/common/constant/Constant.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "316518363089016064040412400530077535607",
            "length": 150
        },
        "id": "CVE-2026-116017-339e86e3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/test/java/xiaozhi/modules/device/controller/DeviceControllerTest.java",
            "function": "controller"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "136868044364311167918769392826308825605",
                "31486935500204367861141541616138669360",
                "8269812889107629934058998997626535151",
                "196818884389984997498862802078853685826",
                "290545248653177373576401336793338786229",
                "194919604046826833258599081899005333396",
                "312652398894456360122232025496576445613",
                "319736006569731442009277386213239665634",
                "141898437782427212753069496134372926008",
                "205220562539382377144655621088946727411",
                "193879684976148798530231415674188200054",
                "153722854755482773207684407947695546348",
                "73960416288270244006820561262872173393",
                "228508861245132316056135722231050675987",
                "184845939192054379555275920861647953794",
                "216409190071380729350436743230474558373",
                "65490537647081160167983348488110557147",
                "193140730647563008737563705612933902715",
                "183812546911114515864988865103543835847",
                "146438668603342487587331826125161919373",
                "129084890127457679952954876305274876503",
                "63954488932980218736674256092559432291",
                "217764830375560765317260180416347952539",
                "45185557309411521763269778450925667270",
                "52820631963383683095252956443520762406",
                "232159352267659571064881534974982587838",
                "53805459923556691962800458476140485089",
                "56006606264162313600160893630635642693"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-116017-39bdbff4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/test/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImplTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "271099668009618464160896200823706985934",
            "length": 1040
        },
        "id": "CVE-2026-116017-3a175439",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java",
            "function": "refreshCache"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "178905581846851927549920111365032997506",
                "327342259104505920770960616797659846158",
                "156800613003819155593607913980662768612",
                "214735404623464708476448897090997388492",
                "299665922449074948378392257088385478719",
                "79178331520355933833569661320337514588",
                "230112956151116232589527977842882141191",
                "318228382862081738002661210922791053382",
                "63316056106008945165288178068288454369",
                "15342910357790281258620589378979082131",
                "243692939106776702601231257080810116080",
                "40854499699601182659837134237927521456",
                "224291006212648256134242945971200884865",
                "125142501116580226138596809882831628874",
                "88164319793825676022789365579705122669",
                "223403071507946949664348688246791427967",
                "59643663998159486193660164093512618711",
                "103261768327813280331877870302467711076",
                "210174740687491591275434467711901486532",
                "307522943866098818066846958133177876902",
                "251097903308250505106790323092394534649",
                "145068454037823624390780874361984393779",
                "202414561345564940553967845402903992130",
                "314140068231384854428640213659455518697",
                "16243828896698689930941259807625536796",
                "192718703967147404874062518553016395963"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-116017-6daa0ca4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/test/java/xiaozhi/modules/device/controller/DeviceControllerTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "106613449514842078607884739402448910970",
            "length": 929
        },
        "id": "CVE-2026-116017-7c33f639",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java",
            "function": "saveOrUpdate"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "247314258616360150111755570346612320346",
            "length": 85
        },
        "id": "CVE-2026-116017-81b9787c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java",
            "function": "getAddressBookList"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "86735885384986005398742846697498975224",
                "94955568237657134076513904905661379240",
                "269487441824463198859494528200176044225",
                "12631786698776718701671811760407550553",
                "28094267342677719618481484460148643529",
                "323538516665628897250455464645742045631",
                "206821250955214843038496050787977740200",
                "98691388849087074264236557271253131911",
                "70603791318684809133827421946844571199",
                "314179844614630270949480102854959370808",
                "318591741346105318284672599071090694219",
                "131156451906833442349882862136126264033",
                "10993608648543087406742211570577774285",
                "58327193059119115190590736292722255759",
                "81760847554355449418969405321784199599",
                "160816749135963424570589222474798292804",
                "51228418843196248285308183835863100059",
                "54960538120317558760458894440714271738",
                "27739200054903020206192798294971072529",
                "99759787867345477505744417343110300195",
                "167971284735990157338350108402269583612",
                "195445680050484467856545570329249852464",
                "311394978066240306216062005820295246396",
                "183405541583062726395717091566119078182",
                "509428888523411158099414253925767211",
                "289756834516831688788524670613348118530",
                "283923522613971123693964485379237059316",
                "303343167374090629100209433177873158593",
                "59275531972098778273852053449200887999",
                "319052729967891577650849132000417788852",
                "140191496430903366343554536612382592181",
                "96865733767485786529509104044735178630",
                "193158792983626326704728506789956034252",
                "157499333441420408027603029831188693689",
                "301447971698855062484988574246472235523",
                "181149818663856253620326552636747244363",
                "201065216257891903249273561139925675788",
                "225073342672045582023807375583778562876",
                "238399235456255207531509567884276605151",
                "114430621661491576558738957594129278659",
                "147750902051770731007752981981726955111",
                "33117276222641985953668280395165811233",
                "175089132680247309150113119046664227510",
                "279758886539549493494852261132711181369",
                "338207625722284004688199593558889483196",
                "219913091410542570595702858829738258970",
                "190794066414586264594401987230784795669",
                "61109285558670167172791789123414816234",
                "106843795681791478436771712435414365149",
                "208644033508040577695432833916790201683",
                "191351836792414689280250571595112794492",
                "39732520236244306901141175233191356684",
                "178886049496232094683468963927988431866",
                "321000510683047606569799447683473003125",
                "249138585016705098177207999011731753196",
                "166825205088960655026109743179750828915",
                "274427346100614941129699916239983702842",
                "329618579639140014710651658812873870792",
                "336609366966905083399641181879593036936",
                "8869558384385161964957442504332373563",
                "65736091548285927117244501079497910137",
                "89116396593851600855288738383575331453",
                "115651010053422422112877230917392435471",
                "321471356308140276770316539175970332467",
                "107552941331642694487753563171629787141",
                "148022729622687737124822364204984556086",
                "115494347478205271502641380221234640085",
                "223041337590146604783602505867689859734",
                "69421797327502516604677015906011940646",
                "6128675838380283188508843432626101290"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-116017-87c5ec52",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281351477364223739315635023710137219064",
            "length": 843
        },
        "id": "CVE-2026-116017-a57fdb42",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/test/java/xiaozhi/modules/device/controller/DeviceControllerTest.java",
            "function": "updateFailureIsReturnedToCaller"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "68351689496135660382845629012153569623",
                "237114352524137077875533829242999730628",
                "155313526261142060542742902712081092911",
                "158583109480634606349917159312891604786",
                "141849963189157170919299281299862370548",
                "43713062950216796499536838070633908032",
                "87162423040614686538035213053103895701",
                "323977275938761060493293741655453560073",
                "302473883602427211948237460321061074344",
                "308418896079490225053221426512202007125",
                "270087894298371499146175025589145147755",
                "234264990138781253716320191459394783005",
                "318070660156159345919848415602996671891",
                "323977275938761060493293741655453560073",
                "302473883602427211948237460321061074344",
                "243654388191563379937992711214699250163"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-116017-a5aad8d4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "133904763126566784437065312906389074331",
            "length": 431
        },
        "id": "CVE-2026-116017-aa32fe83",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java",
            "function": "updatePermission"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "42373829340826942026663022447472440397",
                "317802710395643434040976085893320690752",
                "153960709898377817045559922118518700099",
                "235165426073431547455670537151792560427",
                "118405062804115067368682639198275375598",
                "264470407050919655457648897837624017193",
                "248556926017981661308507848835956229924"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-116017-b1b90218",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceServiceImpl.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "107930966951836931277158454245957032789",
            "length": 1058
        },
        "id": "CVE-2026-116017-bdccb76b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java",
            "function": "callByNickname"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "286311434763626296563988942212385053179",
            "length": 431
        },
        "id": "CVE-2026-116017-bebe7a9d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java",
            "function": "updateAlias"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "229042274786901162976297467488911666756",
            "length": 500
        },
        "id": "CVE-2026-116017-c6a3f0f9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceServiceImpl.java",
            "function": "unbindDevice"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "192377624227110119031835493327557478268",
            "length": 879
        },
        "id": "CVE-2026-116017-d6e9b948",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/test/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImplTest.java",
            "function": "newEntryUsesTheDedicatedAddressBookInsertMapping"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "86379348675481802818834322260260359502",
            "length": 210
        },
        "id": "CVE-2026-116017-f13aa816",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03",
        "target": {
            "file": "main/manager-api/src/main/java/xiaozhi/modules/device/service/impl/DeviceAddressBookServiceImpl.java",
            "function": "formatMacAsDeviceName"
        }
    }
]
vanir_signatures_modified 
"2026-10-25T07:13:45Z"