CVE-2026-8786
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability has been found in Tencent WeKnora up to 0.3.6 in the getKnowledgeBaseForInitialization function of internal/handler/initialization.go in the Config API Endpoint component. Manipulation of the kbId argument leads to authorization bypass, and the attack can be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.
Risk Assessment
A remote attacker can access knowledge base resources without proper authorization, potentially leading to data leakage or modification. The publicly available exploit increases the risk of rapid exploitation.
Recommendation
Upgrade Tencent WeKnora beyond version 0.3.6 as soon as a fix is available, and restrict network access to the Config API Endpoint in the meantime. Monitor logs for unusual initialization calls with manipulated kbId parameters.
Other vulnerabilities in Tencent WeKnora
Original NVD description (English source)
A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS