https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:59:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274993 EUVD-2026-274993 https://cve.radiocsirt.org/vuln/euvd-2026-274993 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30855 <p>WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2.</p> <p>WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-30855 https://cve.radiocsirt.org/vuln/ghsa-ccj6-79j6-cq5q <p><strong>Affected:</strong> Go: github.com/Tencent/WeKnora</p> <p>### Summary An authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical.</p> <p>### Details The tenant management handlers do not validate that the caller owns the tenant or has cross-tenant privileges. The handlers parse the tenant ID from the path and directly call the service layer with that ID, returning or mutating the tenant without authorization checks.</p> <p>Affected handlers: - `GET /api/v1/tenants` lists all tenants without ownership checks - `GET /api/v1/tenants/{id}` reads any tenant by ID without ownership checks - `PUT /api/v1/tenants/{id}` allows updating any tenant by ID without ownership checks - `DELETE /api/v1/tenants/{id}` allows deleting any tenant by ID without ownership checks</p> <p>These endpoints do not enforce cross-tenant permissions or deny-by-default behavior, unlike `ListAllTenants` and `SearchTenants`.</p> <p>### PoC 1) Register a new account as a user in Tenant 10025 and obtain a bearer token or API key.</p> <p>2) Read details of other tenants:</p> <p>- Request that uses API key via the `X-API-Key` header:</p> <p>```http GET /api/v1/tenants HTTP/1.1 Host: localhost Connection: keep-alive X-Request-ID: 2TpH2S0sHyi1 X-AP…</p> <p><strong>Affected:</strong> Go: github.com/Tencent/WeKnora</p> <p>### Summary An authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical.</p> <p>### Details The tenant management handlers do not validate that the caller owns the tenant or has cross-tenant privileges. The handlers parse the tenant ID from the path and directly call the service layer with that ID, returning or mutating the tenant without authorization checks.</p> <p>Affected handlers: - `GET /api/v1/tenants` lists all tenants without ownership checks - `GET /api/v1/tenants/{id}` reads any tenant by ID without ownership checks - `PUT /api/v1/tenants/{id}` allows updating any tenant by ID without ownership checks - `DELETE /api/v1/tenants/{id}` allows deleting any tenant by ID without ownership checks</p> <p>These endpoints do not enforce cross-tenant permissions or deny-by-default behavior, unlike `ListAllTenants` and `SearchTenants`.</p> <p>### PoC 1) Register a new account as a user in Tenant 10025 and obtain a bearer token or API key.</p> <p>2) Read details of other tenants:</p> <p>- Request that uses API key via the `X-API-Key` header:</p> <p>```http GET /api/v1/tenants HTTP/1.1 Host: localhost Connection: keep-alive X-Request-ID: 2TpH2S0sHyi1 X-AP…</p> https://cve.radiocsirt.org/vuln/ghsa-ccj6-79j6-cq5q