CVE-2026-108547: AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated AstronRPA user with access to the get-batch-shared-var endpoint can exploit it. No user interaction is required.
What information could be exposed?
An attacker can read shared variables belonging to other tenants. By enumerating sequential shared-variable IDs, they may recover plaintext credentials stored in all-users variables.
Are tenants protected from each other by default?
No. The affected robot-service lacks the tenant authorization check needed to prevent cross-tenant access through get-batch-shared-var.
How would an attacker retrieve another tenant's variables?
The attacker can enumerate sequential shared-variable IDs through the endpoint. Variables re-encrypted with the attacker's tenant key can then be decrypted by that attacker.