AstronRPA versions up to 1.1.6 contain a missing tenant authorization check in the robot‑service layer. The get‑batch‑shared‑var endpoint permits any authenticated user to read shared variables belonging to other tenants. Attackers can iterate sequential shared variable identifiers, decrypt each variable using their own tenant key, and recover other tenants’ credentials in plaintext. This results in cross‑tenant disclosure of sensitive authentication data, severely compromising confidentiality.

The vulnerability applies to iflytek AstronRPA version 1.1.6 and earlier releases. Any installation of this product that has not been updated beyond version 1.1.6 exposes the get‑batch‑shared‑var API to unauthorized reads across tenant boundaries.

The CVSS score of 7.1 indicates a high potential impact. Although no EPSS score is available, the absence of a KEV listing does not reduce the risk; attackers can exploit the flaw from any authenticated tenant account, enabling cross‑tenant credential theft. The likely attack vector involves an authenticated user accessing the vulnerable endpoint and enumerating variable IDs—an operation that requires legitimate user credentials but otherwise is straightforward to carry out.