Missing Authentication in qKnow Workflow Integration by Qiantong Tech

CVE-2026-111694

What is CVE-2026-111694?

The qKnow platform, specifically version 2.4.3, is vulnerable to a missing authentication flaw that permits remote attackers to bypass security measures and access workflow integration endpoints. This vulnerability allows unauthenticated users to exploit the /flyflow/userById endpoint by submitting sequential userId request values. Consequently, attackers can enumerate sensitive information, such as user phone numbers, roles, and the organizational structure within departments. This security lapse poses a significant risk to the confidentiality of user data and integrity of the system.

References