CVE-2026-110764 Details

A cross-tenant file disclosure vulnerability has been identified in AstronRPA versions through 1.1.6. The issue resides in the resource-service file download endpoint, which lacks proper authorization checks. Authenticated users can exploit this vulnerability by supplying file IDs from other tenants to download S3-stored files. The vulnerability arises because the FileMapper.getFile method does not verify file ownership or tenant affiliation, allowing unauthorized access to files uploaded by other tenants.

To address this vulnerability, it is recommended to implement ownership checks in the file download process. This can be achieved by adding an owner column to the file database schema, populating it with the authenticated user's tenant information during file uploads, and modifying the file retrieval query to include ownership verification. Additionally, consider introducing a formal file sharing model to manage shared files more securely.