QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints. The flaw allows attackers who are not logged in to enumerate file identifiers and retrieve base64-encoded files or parsed document chunks. This results in cross‑tenant exposure of knowledge‑base content, compromising the confidentiality of user data.

The vulnerability affects the QAnything product from Netease‑Youdao at version 2.0.0. No other versions or products are listed as impacted, and the CVE notes that the issue exists in that particular release.

The CVSS score of 8.7 indicates a high severity, and while an EPSS score is not available, the lack of authentication control (CWE‑306) makes the attack path straightforward. An unauthenticated attacker can trigger the API endpoints over the network, enumerate resources, and retrieve content without any prior credential. The vulnerability is not listed in the CISA KEV catalog, but its high impact and straightforward exploitation vector still pose a significant risk.