CVE-2026-116340 Details
Description
A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
An authorization bypass vulnerability has been identified in iFlytek Astron-Agent versions through 1.1.2. The issue arises in the Console Knowledge-List Endpoint, specifically within the FileInfoV2Service.listKnowledgeByPage function of FileInfoV2Service.java. The vulnerability allows authenticated users to bypass ownership checks for knowledge files by manipulating the 'space-id' header in requests. This exploitation can be performed remotely, and a proof-of-concept is publicly available.
To address this vulnerability, the knowledge-list endpoint should be modified to enforce ownership checks for all requested file IDs, regardless of the 'space-id' header. If a header is included, its value should be verified against the user's membership on the server side before processing the request.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Rinne666/poc/blob/main/astron-agent-poc/poc/v2_knowledge_space_id_bypass.py | [email protected] | ExploitTechnical Description |
| https://github.com/Rinne666/poc/tree/main/astron-agent-poc | [email protected] | |
| https://vuldb.com/cve/CVE-2026-116340 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1011582 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426315 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426315/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| iFlytek astron-agent | <= 1.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |