PT-2026-41634 · Tencent · Weknora

Eric-Z · CVE-2026-8786 · Published 2026-05-18 · Updated 2026-05-18

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tencent WeKnora versions prior to 0.3.7

Description An authorization bypass exists in the Config API Endpoint. Remote attackers can exploit this by manipulating the kbId argument within the getKnowledgeBaseForInitialization() function located in the internal/handler/initialization.go file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-8786

Affected Products

Weknora

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8786.json · Exploit
• 🔥 https://vuldb.com/submit/812172 · Exploit
• 🔥 https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8786 · Security Note
• https://osv.dev/vulnerability/CVE-2026-8786 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2056230672679698554 · Twitter Post
• https://t.me/CVEtracker/54096 · Telegram Post
• https://twitter.com/CVEnew/status/2056253243819262038 · Twitter Post
• https://vuldb.com/vuln/364410/cti · Note
• https://t.me/cveNotify/163815 · Telegram Post
• https://vuldb.com/vuln/364410 · Note