CVE-2026-8786: Tencent WeKnora Auth Bypass Vulnerability

CVE-2026-8786 Overview

CVE-2026-8786 is an authorization bypass vulnerability in Tencent WeKnora versions up to 0.3.6. The flaw resides in the getKnowledgeBaseForInitialization function within internal/handler/initialization.go, part of the Config API Endpoint component. An authenticated remote attacker can manipulate the kbId parameter to access knowledge base configuration data belonging to other users. The vulnerability maps to CWE-285: Improper Authorization. A public proof-of-concept exists, and the vendor did not respond to disclosure attempts.

Critical Impact

Authenticated attackers can bypass authorization checks on the Config API Endpoint and access knowledge base initialization data tied to kbId values they do not own.

Affected Products

• Tencent WeKnora versions up to and including 0.3.6
• Deployments exposing the WeKnora Config API Endpoint over a network
• Self-hosted WeKnora instances using internal/handler/initialization.go

Discovery Timeline

• 2026-05-18 - CVE-2026-8786 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-8786

Vulnerability Analysis

The vulnerability exists in the getKnowledgeBaseForInitialization handler in internal/handler/initialization.go. This function processes the kbId argument supplied by a client and returns configuration data for the matching knowledge base. The handler does not adequately verify that the requesting principal is authorized to access the requested kbId. As a result, an attacker who can authenticate to the WeKnora instance can iterate or guess kbId values and retrieve initialization information for knowledge bases owned by other tenants or users.

The scope of disclosed data is limited to information returned by the initialization endpoint, but the missing authorization check undermines the multi-tenant boundary that WeKnora deployments rely on. Exploitation can be performed remotely over the network with low privileges and without user interaction.

Root Cause

The root cause is a missing or incomplete authorization check on a resource identifier supplied by the client. The kbId parameter is treated as a trusted lookup key rather than being validated against the authenticated session's ownership or role. This pattern aligns with CWE-285: Improper Authorization.

Attack Vector

An authenticated attacker sends an HTTP request to the Config API Endpoint with a kbId value belonging to another knowledge base. Because the handler does not enforce ownership, the server returns initialization data for that resource. Technical specifics and reproduction steps are documented in the GitHub PoC Repository and the VulDB #364410 entry. No exploitation code is reproduced here; refer to the public references for verified details.

Detection Methods for CVE-2026-8786

Indicators of Compromise

• Repeated requests to the WeKnora initialization endpoint with sequentially varied or enumerated kbId values from the same session or IP
• Successful HTTP 200 responses to kbId values that do not belong to the authenticated principal
• Unusual access patterns from low-privileged accounts touching multiple knowledge base identifiers in a short interval

Detection Strategies

• Inspect WeKnora application logs for getKnowledgeBaseForInitialization calls and correlate the kbId parameter against the authenticated user's owned resources
• Deploy reverse-proxy or WAF rules that flag enumeration patterns against /initialization style endpoints
• Hunt for cross-tenant access by joining authentication logs with API access logs on the kbId field

Monitoring Recommendations

• Enable verbose audit logging on the Config API Endpoint and forward to a centralized SIEM or data lake
• Alert on a single account accessing more than a defined threshold of distinct kbId values per hour
• Track 4xx-to-2xx transitions on the initialization endpoint that suggest successful authorization bypass after probing

How to Mitigate CVE-2026-8786

Immediate Actions Required

• Restrict network access to the WeKnora Config API Endpoint to trusted administrative networks until a patched version is available
• Audit existing accounts and rotate credentials for any user observed enumerating kbId values
• Review knowledge base contents for unauthorized access and treat exposed configuration data as compromised

Patch Information

At the time of publication, no vendor patch or advisory has been released. The vendor was contacted but did not respond to the disclosure. Monitor the Tencent WeKnora repository and the VulDB #364410 entry for updated fix information. Upgrade to a release later than 0.3.6 once one becomes available that addresses the authorization check in internal/handler/initialization.go.

Workarounds

• Place WeKnora behind an authenticating reverse proxy that enforces per-user ownership on the kbId parameter before requests reach the application
• Apply a local code modification to getKnowledgeBaseForInitialization that validates the authenticated session owns the requested kbId prior to returning data
• Disable or firewall the initialization endpoint if it is not required for production workloads

# Example: restrict the WeKnora API to an internal management subnet using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP