Broken Access Control in WeKnora Framework by Tencent

CVE-2026-30859

What is CVE-2026-30859?

The WeKnora framework by Tencent, designed for advanced document processing, exposes a vulnerability that allows authenticated users to access sensitive data belonging to other tenants. This broken access control flaw arises from inadequate tenant isolation on critical database tables, which include models, messages, and embeddings. As a result, users can potentially read sensitive information such as API keys and private messages, risking privacy and data integrity. The issue has been addressed in version 0.2.12, reinforcing data security through improved access controls.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References