The report
A November 4 source review of langchain4j-aideepin identified three message-reference endpoints whose SQL queries selected knowledge, memory and graph records by a supplied message UUID without also checking the owner. The reporter explicitly did not execute requests against a deployment, so the disclosure establishes an authorization weakness in the code, not observed retrieval of another user’s records.
The UUID was treated as permission
The service accepted a client-supplied conversation ID and loaded associated chat or knowledge under its own backend identity. It did not consistently add the authenticated caller's account to the query. A long random identifier may be difficult to guess, but secrecy of the identifier is not authorization. It can appear in copied links, logs, shared records or internal telemetry; possession alone should not grant access to another user's AI conversation.
The issue evidence is a static review of version 3.31.0, not a controlled two-account reproduction. The Case treats the AI-specific risk as unauthorized retrieval of retained agent context. It does not attribute the flaw to the upstream LangChain4j framework, claim an unauthenticated public dump or document theft from a named production victim. The maintainer linked source commit 483499b and closed the issue on November 9. This supports a code-level correction, but no first fixed package release was established.
There are at least two possible read surfaces: the visible conversation endpoint and the underlying associated memory/graph lookups. Protecting just the first while leaving graph traversals keyed by the same unowned UUID may preserve the exposure. The correct boundary is a principal-bound query at every read, including any summaries or derived memory that refer to the same conversation.
This is an application-side authorization weakness, not a model hallucination or a prompt-injection success. Independent testing with two legitimate users remains needed to measure the behavior on fixed and affected deployments; the published review did not perform that experiment.