Broken Access Control in WeKnora Framework by Tencent
CVE-2026-30859

5.3MEDIUM

Key Information:

Vendor

Tencent

Status
Weknora
Vendor
CVE Published:
7 March 2026

What is CVE-2026-30859?

The WeKnora framework by Tencent, designed for advanced document processing, exposes a vulnerability that allows authenticated users to access sensitive data belonging to other tenants. This broken access control flaw arises from inadequate tenant isolation on critical database tables, which include models, messages, and embeddings. As a result, users can potentially read sensitive information such as API keys and private messages, risking privacy and data integrity. The issue has been addressed in version 0.2.12, reinforcing data security through improved access controls.

Affected Version(s)

WeKnora < 0.2.12

References

https://github.com/Tencent/WeKnora/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.