CVE-2026-8786

Katalog CVE

CVSS 6.3 · Medium EPSS 0,42%

Kerentanan Improper Authorization pada tencent weknora. Skor CVSS 3.1 6.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

18 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b exploit · advisory pihak ketiga
• https://vuldb.com/submit/812172 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/364410 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/364410/cti permissions required · vdb entry