CVEvulnerability
CVE-2026-82475
8.6 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-08-29
- Last modified
- 2026-09-10
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-862
Description
iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/iflytek/astron-agent github.com
- https://github.com/iflytek/astron-agent/blob/v1.1.1/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java github.com
- https://github.com/iflytek/astron-agent/issues/1590 github.com
- https://www.vulncheck.com/advisories/iflytek-astron-agent-through-1.1.1-workflow-hijacking-via-missing-ownership-check www.vulncheck.com
- https://github.com/iflytek/astron-agent/issues/1590 github.com