PT-2026-23894 · Shy2593666979 · Agentchat

Vuldb · Published 2026-03-08 · Updated 2026-03-13 · CVE-2026-3693

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Shy2593666979 AgentChat versions prior to 2.3.1

Description A flaw exists in Shy2593666979 AgentChat related to improper control of resource identifiers. The issue resides within the get user info/update user info function located in the /src/backend/agentchat/api/v1/user.py file of the User Endpoint component. Manipulation of the user id argument can trigger the issue, and the attack can be initiated remotely. The exploit for this issue has been published.

Recommendations Update Shy2593666979 AgentChat to version 2.3.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-99

Related Identifiers

CVE-2026-3693

Affected Products

Agentchat

References · 14

• 🔥 https://github.com/CC-T-454455/Vulnerabilities/tree/master/agent-chat/vulnerability-2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3693 · Security Note
• https://github.com/CC-T-454455/Vulnerabilities/tree/master/agent-chat/vulnerability-1 · Note
• https://vuldb.com/?id.349640 · Note
• https://twitter.com/cyberbivash/status/2030453850180596047 · Twitter Post
• https://vuldb.com/?submit.765590 · Note
• https://twitter.com/RedPacketSec/status/2030520450430726215 · Twitter Post
• https://twitter.com/cracbot/status/2032049063244546303 · Twitter Post
• https://t.me/CVEtracker/46767 · Telegram Post
• https://twitter.com/CVEnew/status/2030747895683821608 · Twitter Post
• https://twitter.com/cracbot/status/2032411400170271048 · Twitter Post
• https://vuldb.com/?submit.765589 · Note
• https://t.me/cveNotify/154638 · Telegram Post
• https://vuldb.com/?ctiid.349640 · Note