Insecure Direct Object Reference in AstronRPA Resource-Service
CVE-2026-110764

6MEDIUM

Key Information:

Vendor

Iflytek

Status
Astron-rpa
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-110764?

AstronRPA versions up to 1.1.6 are susceptible to an insecure direct object reference vulnerability, specifically found in the /file/download endpoint. This flaw allows authenticated users to gain unauthorized access to files belonging to other tenants by merely specifying the fileId. Attackers can exploit this vulnerability by enumerating predictable Snowflake file IDs, as the FileMapper.getFile method fails to implement necessary checks for ownership or tenant authorization. Consequently, sensitive files stored in S3 can be retrieved by unauthorized users, leading to potential data breaches.

Affected Version(s)

astron-rpa 0 <= 1.1.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-110764 - Proof of Concept

References

https://hackmd.io/@hieuPenguinnn/iflytek-astron-rpa-file-...
technical-descriptionexploit
https://github.com/iflytek/astron-rpa/blob/b66e7c9e445906...
technical-description
https://github.com/iflytek/astron-rpa
product

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.