CVE-2026-30855
WeKnora: Broken Access Control in Tenant Management
Reported by github_m · Published March 7, 2026
github.com/Tencent/WeKnora is fixed in 0.3.2 (Go Modules)
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/Tencent/WeKnora | Go Modules | 0.3.2 |
| weknora | tencent | 0.3.2 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Tencent | WeKnora | < 0.3.2 |
| github.com | Tencent/WeKnora | 0 |
| Tencent | WeKnora | 0 |
Timeline
- Mar 6, 2026 CVE Published
- Mar 7, 2026 PoC Published
- Mar 8, 2026 EPSS Score (30 in total, the first dated here)
- Mar 9, 2026 CVE Updated
- Mar 17, 2026 Coalition ESS Score (2 in total, the first dated here)
- Mar 17, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-30855
vulnetix vdb fixes CVE-2026-30855Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-30855/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart