Filtered by vendor Wannabespace Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-119663 1 Wannabespace 1 Tamery 2026-10-31 4.3 Medium
Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.
CVE-2026-119664 1 Wannabespace 1 Tamery 2026-10-31 4.3 Medium
Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.