CVE-2026-116340: iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization
A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs low-privileged access because the reported vector requires privileges. Exploitation can be performed remotely and does not require user interaction.
What information could be exposed?
Manipulating the space-id argument can bypass authorization in the Console Knowledge-List Endpoint. The reported impact is limited to confidentiality, indicating unauthorized access to knowledge-list data rather than modification or service disruption.
Which versions are affected?
iFlytek astron-agent versions up to and including 1.1.2 are reported as affected. The available data does not identify a fixed version.
How urgent is remediation?
The vulnerability is rated medium severity with a 4.3 score, but public exploit availability is reported. Prioritize systems where low-privileged remote users can access the Console Knowledge-List Endpoint.
Is vendor remediation available?
The available information does not identify a vendor patch or other remediation. The vendor was contacted before disclosure but reportedly did not respond.