CVE-2026-8786CWE-285CWE-639

CVE-2026-8786

Medium · published May 18, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
35.2
In the wild
Unconfirmed
What it is

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.2th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-18T08:16Z
Affected products (1)
ProductVersionsFixed in
tencent/weknora≤ 0.3.6—
References (4)
https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b · [email protected]https://vuldb.com/submit/812172 · [email protected]https://vuldb.com/vuln/364410 · [email protected]https://vuldb.com/vuln/364410/cti · [email protected]
EPSS history
Timeline
  • 18 MAY 03:00Z
    Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization
    cvelistv5