CVE-2026-82475
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
iFlytek astron-agent through version 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.
Risk Assessment
The risk includes unauthorized access to other tenants' workflow data and the possibility of modification, which could lead to confidentiality and integrity breaches.
Recommendation
It is recommended to update iFlytek astron-agent to a version that validates workflow ownership in the copyFlow endpoint, and to implement tenant-based access controls.
Other vulnerabilities in iFlytek astron-agent
See all- CVE-2026-108864Medium
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation.
- CVE-2026-95930Medium
SSRF vulnerability in iFlytek astron-agent up to 1.0.6. Affects UrlCheckTool.checkUrl in debugToolV2 API endpoint. Manipulation of endPoint argument allows remote SSRF. Patch available in version reward-1575.
- CVE-2026-95929Medium
SQL Injection vulnerability in iFlytek astron-agent up to 1.0.7. Affects function in ChatBotMarketMapper.xml in getBotList API endpoint. Manipulation of sortDirection argument allows remote SQL injection. Patch in version reward-1575.
Original NVD description (English source)
iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS