CVE-2026-85671 Details
Description
QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and retrieve base64-encoded files or parsed document chunks without ownership verification to disclose cross-tenant knowledge base content.
An authentication bypass vulnerability has been identified in QAnything version 2.0.0. The issue resides within the '/api/local_doc_qa/get_file_base64' and '/api/local_doc_qa/get_doc' endpoints, allowing unauthenticated attackers to access any uploaded file or document. This vulnerability enables the enumeration of file identifiers through unauthenticated endpoints, and the retrieval of base64-encoded files or parsed document chunks without ownership verification, thereby disclosing cross-tenant knowledge base content.
To address this vulnerability, implement authentication checks for the affected endpoints. Ensure that file and document requests are validated against the user's ownership before granting access. Additionally, apply the same authentication requirements to other read endpoints that currently lack proper verification.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netease-youdao/QAnything | [email protected] | ProductSource CodeVendor |
| https://github.com/netease-youdao/QAnything/blob/v2.0.0/qanything_kernel/qanything_server/handler.py | [email protected] | Source CodeVendor |
| https://github.com/netease-youdao/QAnything/issues/670 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/qanything-2.0.0-unauthenticated-cross-user-file-disclosure | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netease-youdao QAnything | <= 2.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |