{"data":{"id":"796ff3cc-d6b3-44fa-bf03-938ce60c4823","title":"GHSA-2f4c-vrjq-rcgv: WeKnora has Broken Access Control - Cross-Tenant Data Exposure","summary":"WeKnora's database query tool fails to enforce tenant isolation on the models, messages and embeddings tables, which are allowed by WithSecurityDefaults() but absent from the tenantID-filtered list in internal/utils/inject.go. Any authenticated tenant can run SELECT queries against these tables and read other tenants' data, including API keys, model configurations and private messages, with no extra precondition beyond ordinary user access.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://github.com/advisories/GHSA-2f4c-vrjq-rcgv","publishedAt":"2026-03-06T23:57:20.000Z","cveId":"CVE-2026-30859","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/Tencent/WeKnora@<= 2.0.11"],"affectedPackageNames":["github.com/tencent/weknora"],"affectedPackageRefs":["go:github.com/tencent/weknora"],"affectedVendors":[],"affectedVendorsRaw":["WeKnora"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00242,"epssCheckedAt":"2026-11-04T12:08:33.434Z","kevDateAdded":null,"advisoryAliases":["GHSA-2f4c-vrjq-rcgv"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}