https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-17T12:36:27.240754+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-110764 CVE-2026-110764 — AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download 2026-10-17T12:36:27.242029+00:00

Affected: iflytek astron-rpa

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants.