PT-2026-41634 · Tencent · Weknora

Eric-Z · Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-8786

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tencent WeKnora versions prior to 0.3.7

Description An authorization bypass exists in the Config API Endpoint. Remote attackers can exploit this by manipulating the kbId argument within the getKnowledgeBaseForInitialization() function located in the internal/handler/initialization.go file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2026-8786

Affected Products

Weknora

References · 8

• 🔥 https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8786 · Security Note
• https://t.me/cveNotify/163815 · Telegram Post
• https://vuldb.com/vuln/364410/cti · Note
• https://twitter.com/CVEnew/status/2056253243819262038 · Twitter Post
• https://vuldb.com/submit/812172 · Note
• https://twitter.com/VulmonFeeds/status/2056230672679698554 · Twitter Post
• https://vuldb.com/vuln/364410 · Note