CVE-2026-8786: Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization
A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8786?
CVE-2026-8786 has been classified with a high severity level due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2026-8786?
To fix CVE-2026-8786, upgrade Tencent WeKnora to version 0.3.7 or later as it includes patches for this vulnerability.
What type of vulnerability is CVE-2026-8786?
CVE-2026-8786 is an authorization vulnerability found in the getKnowledgeBaseForInitialization function of Tencent WeKnora.
What are the potential impacts of CVE-2026-8786?
The potential impacts of CVE-2026-8786 include unauthorized access to configuration data and the possibility of performing actions without proper authorization.
Which versions of Tencent WeKnora are affected by CVE-2026-8786?
CVE-2026-8786 affects all versions of Tencent WeKnora up to and including version 0.3.6.