Missing Authorization Vulnerability in Dromara mayfly-go AI Assistant

CVE-2026-92992

What is CVE-2026-92992?

A security vulnerability has been identified in the Dromara mayfly-go AI Assistant, specifically within the file server/internal/ai/api/ai.go component. This vulnerability allows for missing authorization, leading to potential remote exploitation. Notably, the issue arises from a whitelist bypass affecting anyone with the appropriate session user credentials, where commands utilizing tools like curl, wget, or sed can execute without prior approval. This can create significant security risks as malicious actors may exploit this loophole. The recommended course of action involves applying the necessary patch to mitigate potential impacts.

References