qKnow 2.4.3 contains a missing authentication flaw that allows remote attackers to post to the /flyflow/userById endpoint and call other integration endpoints such as roleAll and deptListByParentDeptId without providing credentials. This enables enumeration of phone numbers, roles and department structure, effectively exposing personal and organizational information that should remain private according to the application’s security policy.

The vulnerability affects the qiantongtech qKnow product, specifically version 2.4.3 and any deployments that include the qknow-framework and qknow-module-system components as delivered by that release.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is reported, so the current exploitation probability is unclear, but the flaw permits unauthenticated network access, which typically results in a predictable and straightforward attack path. The vulnerability is not listed in the CISA KEV catalog, yet the lack of authentication control remains a critical weakness that an attacker could exploit from any location with network reach to the /flyflow endpoints.