{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-02T04:02:17.018","vulnerabilities":[{"cve":{"id":"CVE-2026-30859","sourceIdentifier":"security-advisories@github.com","published":"2026-03-07T17:15:53.673","lastModified":"2026-06-17T10:33:02.907","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a broken access control vulnerability in the database query tool allows any authenticated tenant to read sensitive data belonging to other tenants, including API keys, model configurations, and private messages. The application fails to enforce tenant isolation on critical tables (models, messages, embeddings), enabling unauthorized cross-tenant data access with user-level authentication privileges. This issue has been patched in version 0.2.12."},{"lang":"es","value":"WeKnora es un framework impulsado por LLM diseñado para la comprensión profunda de documentos y la recuperación semántica. Antes de la versión 0.2.12, una vulnerabilidad de control de acceso roto en la herramienta de consulta de la base de datos permite a cualquier inquilino autenticado leer datos sensibles pertenecientes a otros inquilinos, incluyendo claves de API, configuraciones de modelos y mensajes privados. La aplicación no logra aplicar el aislamiento de inquilinos en tablas críticas (modelos, mensajes, embeddings), lo que permite el acceso no autorizado a datos entre inquilinos con privilegios de autenticación a nivel de usuario. Este problema ha sido parcheado en la versión 0.2.12."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Tencent","product":"WeKnora","versions":[{"version":"< 0.2.12","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-09T17:52:16.344939Z","id":"CVE-2026-30859","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:*","versionEndExcluding":"0.2.12","matchCriteriaId":"7B86D061-D1A8-438E-802E-D5408C339349"}]}]}],"references":[{"url":"https://github.com/Tencent/WeKnora/security/advisories/GHSA-2f4c-vrjq-rcgv","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}