CVE-2026-30859 json
WeKnora: Broken Access Control - Cross-Tenant Data Exposure
published 2026-03-06 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-10182 , GHSA-2f4c-vrjq-rcgv , GO-2026-4637
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a broken access control vulnerability in the database query tool allows any authenticated tenant to read sensitive data belonging to other tenants, including API keys, model configurations, and private messages. The application fails to enforce tenant isolation on critical tables (models, messages, embeddings), enabling unauthorized cross-tenant data access with user-level authentication privileges. This issue has been patched in version 0.2.12.
Patch / fix
- go github.com/Tencent/WeKnora 0.2.12
- tencent weknora 0.2.12
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260317T205859-150000.1.152.1
suse advisories SUSE-SU-2026:1042-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/Tencent/WeKnora | <0.2.12 all versions |
0.2.12 |
Affected products
- Tencent WeKnora
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/Tencent/WeKnora/security/advisories/GHSA-2f4c-vrjq-rcgv
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-30859
advisory
-
github.com
/Tencent/WeKnora
package
Sources
- CVE List CVE-2026-30859
- GitHub Advisory GHSA-2f4c-vrjq-rcgv
- NVD CVE-2026-30859
- OSV GO-2026-4637
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.