CVE-2026-3693

HIGH 7.3

Shy2593666979 AgentChat User Endpoint user.py update_user_info resource injection

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in Shy2593666979 AgentChat up to 2.3.0. This issue affects the function get_user_info/update_user_info of the file /src/backend/agentchat/api/v1/user.py of the component User Endpoint. This manipulation of the argument user_id causes improper control of resource identifiers. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-99
Vendor	shy2593666979
Product	agentchat
Published	Mar 8, 2026
Last Updated	Mar 11, 2026

Stay Ahead of the Next One

Get instant alerts for shy2593666979 agentchat

Be the first to know when new high vulnerabilities affecting shy2593666979 agentchat are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Shy2593666979 / AgentChat

2.0 2.1 2.2 2.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/?id.349640 vuldb.com: https://vuldb.com/?ctiid.349640 vuldb.com: https://vuldb.com/?submit.765589 vuldb.com: https://vuldb.com/?submit.765590 github.com: https://github.com/CC-T-454455/Vulnerabilities/tree/master/agent-chat/vulnerability-1 github.com: https://github.com/CC-T-454455/Vulnerabilities/tree/master/agent-chat/vulnerability-2

Credits

VulDB