{"data":{"id":"a67ea3b7-f725-466d-9959-27a0b8b5bcdc","title":"GHSA-ccj6-79j6-cq5q: WeKnora Vulnerable to Broken Access Control in Tenant Management","summary":"WeKnora's tenant management endpoints (GET /api/v1/tenants, GET, PUT and DELETE /api/v1/tenants/{id}) do not check that the caller owns the tenant or holds cross-tenant privileges. Any authenticated user can therefore read, modify or delete any tenant by ID, and because account registration is open, an unauthenticated attacker can register and exploit this. The reporter demonstrates that listing tenants exposes other tenants' API keys, which grant actions on those accounts.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-ccj6-79j6-cq5q","publishedAt":"2026-03-06T23:53:53.000Z","cveId":"CVE-2026-30855","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/Tencent/WeKnora@< 0.3.1 (fixed: 0.3.1)"],"affectedPackageNames":["github.com/tencent/weknora"],"affectedPackageRefs":["go:github.com/tencent/weknora"],"affectedVendors":[],"affectedVendorsRaw":["WeKnora"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00377,"epssCheckedAt":"2026-11-04T12:08:35.127Z","kevDateAdded":null,"advisoryAliases":["GHSA-ccj6-79j6-cq5q"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-10T05:11:52.000Z","daysToFix":-24,"fixCheckedAt":"2026-10-29T21:40:04.664Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/Tencent/WeKnora","fixedVersion":"0.3.1","matchedVersion":"v0.3.1","fixReleasedAt":"2026-02-10T05:11:52.000Z","daysToFix":-24,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:04.514Z"}]}}