A broken access control flaw in the database query tool of WeKnora permits an authenticated tenant to read sensitive data from other tenants, including API keys, model configurations, and private messages. This violates the isolation principle and is identified as a CWE‑284 type vulnerability, exposing confidentiality of data that should be tenant‑specific.

Tencent’s WeKnora framework is affected. All deployments running a version prior to 0.2.12 are vulnerable. The issue was fixed in the 0.2.12 release, so any earlier installation carries risk.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The flaw requires user‑level authentication, so attackers must gain legitimate access as a tenant user. Because the vulnerability is not listed in the CISA KEV catalog, there is no publicly known active exploitation at the time of this analysis.