Broken Object Level Authorization (BOLA) vulnerability in the Ansible Lightspeed AI conversation endpoints. The flaw occurs due to missing ownership validation of the conversation_id parameter in the /api/v0/ai/chat/, /api/v1/ai/chat/, and streaming chat APIs. Although UUIDs are used, the backend does not verify that the authenticated user owns the referenced conversation, and conversations are incorrectly mapped to a default null user ID. An authenticated attacker who obtains a valid conversation identifier can access prior conversation history and inject new prompts into another user’s AI session, potentially influencing generated Ansible playbooks. This can be exploited remotely without user interaction and leads to unauthorized information disclosure and integrity compromise.