CVE-2026-30855: Tencent Weknora Auth Bypass Vulnerability

CVE-2026-30855 Overview

CVE-2026-30855 is an authorization bypass vulnerability in WeKnora, an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, the tenant management endpoints lack proper authorization controls, allowing any authenticated user to read, modify, or delete any tenant by ID. Combined with the application's open public registration, this vulnerability enables unauthenticated attackers to register an account and subsequently exploit the system for cross-tenant account takeover and data destruction.

Critical Impact

This authorization bypass enables cross-tenant account takeover and destruction. Any unauthenticated attacker can register a public account and then access, modify, or delete any tenant's data across the entire system.

Affected Products

• Tencent WeKnora versions prior to 0.3.2

Discovery Timeline

• 2026-03-07 - CVE-2026-30855 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-30855

Vulnerability Analysis

This authorization bypass vulnerability (CWE-284: Improper Access Control) exists in the tenant management endpoints of the WeKnora application. The core issue is that the application fails to verify whether an authenticated user has legitimate access to a specific tenant before processing requests to read, modify, or delete that tenant's data.

The attack surface is expanded significantly by WeKnora's open registration model. Since any user can create an account without administrative approval, an external attacker can easily obtain valid credentials to exploit this flaw. Once authenticated, the attacker can enumerate tenant IDs and perform unauthorized operations against any tenant in the system.

The impact is particularly severe in multi-tenant environments where data isolation between organizations is critical. An attacker could exfiltrate sensitive documents processed by other tenants, corrupt or destroy tenant configurations, or completely take over other tenant accounts by modifying their settings.

Root Cause

The root cause is missing authorization checks in the tenant management API endpoints. When processing requests that include a tenant ID parameter, the application authenticates the user but fails to verify that the authenticated user is authorized to access the specified tenant. This creates a horizontal privilege escalation scenario where any authenticated user can access resources belonging to any other tenant.

Attack Vector

The attack follows a straightforward path exploiting the open registration combined with missing tenant authorization:

1. An attacker discovers the WeKnora instance and registers a new account through the public registration functionality
2. After authentication, the attacker identifies tenant management API endpoints
3. By manipulating the tenant ID parameter in requests, the attacker can enumerate and access other tenants
4. The attacker can then read sensitive data, modify tenant configurations, or delete tenant resources

Since authentication is the only barrier and registration is public, the vulnerability effectively allows unauthenticated access to all tenant data across the system. For technical details and verification, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-30855

Indicators of Compromise

• Unusual API requests to tenant management endpoints with tenant IDs that don't belong to the requesting user
• Newly registered accounts immediately accessing multiple tenant endpoints
• High volume of enumeration attempts against tenant ID parameters
• Unexpected modifications or deletions of tenant configurations

Detection Strategies

• Monitor authentication logs for newly created accounts followed by suspicious tenant API access patterns
• Implement anomaly detection for users accessing tenant IDs they haven't accessed before
• Log and alert on all tenant modification and deletion operations with user-tenant relationship validation
• Track API requests that return tenant data for users without legitimate tenant associations

Monitoring Recommendations

• Enable detailed audit logging for all tenant management API endpoints
• Set up alerts for bulk tenant enumeration patterns (sequential or rapid ID access)
• Monitor for accounts created and immediately used for cross-tenant access
• Review access logs for requests containing tenant IDs mismatched with user ownership

How to Mitigate CVE-2026-30855

Immediate Actions Required

• Upgrade WeKnora to version 0.3.2 or later immediately
• Audit tenant management API access logs for signs of exploitation
• Review recently registered accounts for suspicious activity patterns
• Consider temporarily restricting public registration until the patch is applied

Patch Information

Tencent has released version 0.3.2 of WeKnora which addresses this authorization bypass vulnerability. The patch implements proper tenant-level authorization checks in the affected endpoints. Organizations should upgrade to version 0.3.2 or later as soon as possible. For detailed patch information, see the GitHub Security Advisory.

Workarounds

• Implement network-level access controls to restrict access to tenant management endpoints
• Deploy a web application firewall (WAF) rule to validate tenant ID parameters against user session data
• Temporarily disable public registration to prevent new malicious account creation
• Add an application-layer proxy that enforces tenant authorization until the official patch can be applied

# Example: Restrict tenant management endpoints at reverse proxy level
# Add to nginx configuration to limit access while awaiting patch
location ~ ^/api/tenant/ {
    # Only allow access from trusted internal networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}