A langchain4j-aideepin chat endpoint returned another user's agent memory by conversation ID

A November 4 static review of langchain4j-aideepin version 3.31.0 found three CharacterMessageController reference endpoints that loaded associated knowledge embeddings, long-term memory content and graph edges from a client-supplied message UUID. The SQL mapper queries matched the UUID without binding the authenticated principal or message owner. A legitimate user who obtained another user's message UUID could therefore potentially retrieve private AI-associated content using the application's backend authority. The original reporter explicitly did not execute requests against an affected deployment, so a completed cross-account read must not be reported as demonstrated. The possible leak requires an authenticated caller and knowledge of another user's otherwise nonsequential UUID; guessing an identifier is not itself evidence of exploitation.

The defect concerns the aideepin application, not a demonstrated vulnerability in the upstream LangChain4j framework. Sibling code already performed owner checks on deletion and other paths, indicating that message-reference endpoints needed the same enforcement. On November 9 the repository maintainer referenced source fix 483499b and closed issue #118. That establishes a code correction but does not independently identify the first safe distributed build or confirm that historical installations applied it.

Remediation requires caller ownership checking before reference reads, or an owner predicate throughout SQL joins, including knowledge, memory and graph paths. Confirm that authorized users retain their access, a second account cannot retrieve their message data, and the installed build actually includes the referenced fix. No real production customer exfiltration or exploited tenant is documented.