Technical impact
A broken access control flaw in the tenant management endpoints of WeKnora allows any authenticated user to perform actions on any tenant by ID, effectively enabling cross‑tenant account takeover. Because account registration is open to the public, an attacker can create a new user account and then exploit the same flaw. The vulnerability permits full read, modify, and delete rights, compromising confidentiality, integrity, and availability of tenant data. The weakness is a classic authorization bypass, identified as CWE‑284.
Affected Systems
Tencent WeKnora, any deployment running a version before 0.3.2 is vulnerable. All tenants hosted on those instances are affected until the software is updated to 0.3.2 or later.
Risk and Exploitability
The CVSS score of 8.8 classifies the risk as high, but the EPSS of less than 1 percent indicates a low probability of real‑world exploitation at the time of analysis. The flaw is not listed in CISA’s KEV catalog. Exploitation is straightforward: an attacker registers an account, requests the tenant ID to target, and then uses the unauthorized endpoint to read, alter, or delete tenant data. No special conditions beyond authentication are required, making the attack vector simple and the impact critical.
Github GHSA