Live › vulnerability › CVE-2026-116340
Go to dashboardThe Console Knowledge-List endpoint in iFlytek astron-agent up to 1.1.2 does not properly check authorization when the space-id argument is manipulated. A remote attacker can list knowledge bases in spaces they should not be able to see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Teams running iFlytek astron-agent up to version 1.1.2 with the Console knowledge-list feature reachable over the network. The sources do not describe other configurations; unknown whether deployments behind a login proxy are protected.
No product ranges from the sources yet.
1.1.2; unknown whether a fixed version has been releasedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116340")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.