CVE-2026-111694: qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints
qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated access?
qKnow versions through 2.4.3 are affected where the /flyflow workflow integration endpoints are permitted by SecurityConfig. The issue is remotely reachable and does not require authentication or user interaction.
What information can an unauthenticated attacker obtain?
An attacker can POST sequential userId values to /flyflow/userById to enumerate user phone numbers. The roleAll and deptListByParentDeptId endpoints can disclose roles and department structure.
How can defenders check whether their instance is affected?
Review whether /flyflow endpoints are allowed without authentication in the deployed SecurityConfig. Test access to /flyflow/userById, roleAll, and deptListByParentDeptId without credentials only in an authorized environment.