High severity8.8NVD Advisory· Published Mar 7, 2026· Updated Jun 17, 2026
CVE-2026-30855
CVE-2026-30855
Description
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/Tencent/WeKnoraGo | < 0.3.2 | 0.3.2 |
Affected products
5- ghsa-coords3 versionspkg:golang/github.com/tencent/weknorapkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 0.3.2+ 2 more
- (no CPE)range: < 0.3.2
- (no CPE)range: < 0.0.20260317T205859-150000.1.152.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
3- github.com/Tencent/WeKnora/security/advisories/GHSA-ccj6-79j6-cq5qnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-ccj6-79j6-cq5qghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-30855ghsaADVISORY
News mentions
0No linked articles in our index yet.