CVE-2026-82475CWE-862broken-access-control

CVE-2026-82475

High · published August 29, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00448 · 37.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-29T21:18Z
References (5)
https://github.com/iflytek/astron-agent · [email protected]https://github.com/iflytek/astron-agent/blob/v1.1.1/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java · [email protected]https://github.com/iflytek/astron-agent/issues/1590 · [email protected]https://www.vulncheck.com/advisories/iflytek-astron-agent-through-1.1.1-workflow-hijacking-via-missing-ownership-check · [email protected]https://github.com/iflytek/astron-agent/issues/1590 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 29 AUG 16:35Z
    iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check
    cvelistv5