Live › vulnerability › CVE-2026-111694
Go to dashboardqKnow through 2.4.3 exposes its /flyflow workflow integration endpoints without authentication because SecurityConfig permits them. An unauthenticated remote attacker can enumerate user phone numbers, roles and department structure by posting sequential userId values.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run qKnow 2.4.3 or earlier with the /flyflow workflow integration exposed to a network the attacker can reach. The flaw is in the permit rules, so any deployment using the default SecurityConfig is exposed. Instances not reachable from outside the network, or running a newer version, are less exposed.
No product ranges from the sources yet.
/flyflow/userById or /flyflow/roleAll without a session token and see whether data is returned./flyflow/** paths.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.
This page as .md · .json · in your agent: get_signal("CVE-2026-111694")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.