high severity ยท published 2026-11-03
In apps that enable a client-side operation timeout, an unauthenticated attacker sending ordinary requests can cause database replies to be paired with the wrong requests. This can disclose other users' records, return incorrect results, and break legitimate requests.
Fixed in: 7.8.0
CVE: CVE-2026-119179
Source: NVD
Fixlane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the Fixlane MCP server and call get_fix_prompt with incident id 669 and your operating system.