CVE-2026-30855 WeKnora: Broken Access Control in Tenant Management
An authorization bypass in WeKnora allows any registered user to read, modify, or delete any tenant, enabling cross-tenant account takeover and data destruction.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30855?
CVE-2026-30855 is a high-severity missing authorization vulnerability in Tencent WeKnora, published on 7 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2.
Weakness: CWE-284
Which versions are affected by CVE-2026-30855?
3 open source packages ship an affected version, including github.com/Tencent/WeKnora. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/Tencent/WeKnora Go | All versions | 0.3.1 |
github.com/Tencent/WeKnora Go | All versions | 0.3.2 |
github.com/Tencent/WeKnora Go | All versions | 0.3.2 |
Products include Tencent Weknora.
How do I fix CVE-2026-30855?
Upgrade github.com/Tencent/WeKnora to a fixed version for your release line: 0.3.1 or 0.3.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-30855 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30855 exists.
Other vulnerabilities in Tencent WeKnora
- CVE-2026-30860 WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool
- CVE-2026-30861 WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation
- CVE-2026-22688 WeKnora has Command Injection in MCP stdio test
- CVE-2025-11046 Tencent WeKnora test testEmbeddingModel server-side request forgery
- CVE-2026-30858 WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources
Sources
Also known as GHSA-ccj6-79j6-cq5q, GO-2026-4642.