github.com
https://github.com/Tencent/WeKnora CVE-2026-30859
MEDIUM
WeKnora: Broken Access Control - Cross-Tenant Data Exposure
Record summary
CVE-2026-30859 has a selected CVSS score of 5.3 (medium).
Description
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a broken access control vulnerability in the database query tool allows any authenticated tenant to read sensitive data belonging to other tenants, including API keys, model configurations, and private messages. The application fails to enforce tenant isolation on critical tables (models, messages, embeddings), enabling unauthorized cross-tenant data access with user-level authentication privileges. This issue has been patched in version 0.2.12.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 9, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
WeKnoraBrowse Tencent / WeKnora | CVE List | < 0.2.12 | affected |
github.com/Tencent/WeKnoraBrowse Go / github.com/Tencent/WeKnora | GitHub Advisory | Before 0.2.12 · Fixed in 0.2.12 | affected |
References
3github.comConfirmation
https://github.com/Tencent/WeKnora/security/advisories/GHSA-2f4c-vrjq-rcgv nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-30859