CVE-2026-108547 Details
Description
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.
A vulnerability in AstronRPA versions through 1.1.6 exists due to a missing tenant authorization check in the robot-service component. This flaw enables authenticated users to access shared variables of other tenants via the get-batch-shared-var endpoint. Exploitation involves enumerating shared variable IDs and decrypting variables shared with all users using the caller's tenant key, potentially leading to the disclosure of other tenants' credentials in plaintext.
A fix has been implemented in AstronRPA version 1.1.7, which adds the necessary tenant authorization checks to the affected endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| iflytek AstronRPA | <= 1.1.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |