Insecure Direct Object Reference in BISHENG Affected by Document Access Flaw
CVE-2026-111363

7.1HIGH

Key Information:

Vendor

Dataelement

Status
Bisheng
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111363?

BISHENG versions up to 3.0.0-beta4 are susceptible to an insecure direct object reference (IDOR) vulnerability that enables authenticated low-privileged users to gain unauthorized access to the parsed documents of other users. By manipulating the 'file_id' parameter within API requests to /api/v1/knowledge/file_bbox, attackers can sequentially enumerate file IDs, allowing them to retrieve sensitive information from the knowledge bases of other users and tenants without proper authorization.

Affected Version(s)

bisheng 0 <= 3.0.0-beta4

References

https://hackmd.io/@hieuPenguinnn/bisheng-knowledge-file-b...
third-party-advisory
https://github.com/dataelement/bisheng/blob/v3.0.0-beta4/...
technical-description
https://github.com/dataelement/bisheng/blob/v3.0.0-beta4/...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.