CVE-2026-85671: QAnything 2.0.0 Unauthenticated Cross-User File Disclosure
QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and retrieve base64-encoded files or parsed document chunks without ownership verification to disclose cross-tenant knowledge base content.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of QAnything 2.0.0 that expose the affected API endpoints are exposed. The issue can disclose uploaded files and parsed document content across knowledge base tenants.
What does an attacker need to exploit it?
An attacker does not need authentication, privileges, or user interaction. They can enumerate file identifiers through unauthenticated endpoints and use them to request file or document data.
Which endpoints are involved?
The affected endpoints are /api/local_doc_qa/get_file_base64, which can return base64-encoded uploaded files, and /api/local_doc_qa/get_doc, which can return parsed document chunks.
How can defenders determine whether data may be exposed?
Review whether unauthenticated requests to the affected endpoints can enumerate file identifiers and retrieve files or document chunks for content not owned by the requester. Successful cross-tenant retrieval indicates exposure.