Cross-Tenant Authorization Bypass in WeKnora Framework by Tencent

CVE-2026-30857

What is CVE-2026-30857?

The WeKnora framework, which leverages LLM technology for deep document understanding, is susceptible to a cross-tenant authorization bypass vulnerability in its knowledge base copy endpoint. This flaw enables authenticated users to clone another tenant's knowledge base if they can determine the source knowledge base ID. As a result, this vulnerability poses a significant risk of bulk data exfiltration, potentially allowing unauthorized access to documents and FAQs across different tenants. The issue has been securely resolved in version 0.3.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References