8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30855

CVE-2026-30855: WeKnora: Broken Access Control in Tenant Management

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.2, an authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical. This issue has been patched in version 0.3.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30855

CVE-2026-30855:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/Tencent/WeKnora	go	< 0.3.1	0.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security advisory describes a critical Broken Object Level Authorization (BOLA) vulnerability in WeKnora's tenant management API. The core of the issue is that the API handlers for getting, listing, updating, and deleting tenants did not perform any authorization checks to ensure that the user making the request had the necessary permissions for the target tenant. The vulnerable functions are the HTTP handlers in internal/http/handler/tenant_handler.go corresponding to the endpoints GET /api/v1/tenants, GET /api/v1/tenants/{id}, PUT /api/v1/tenants/{id}, and DELETE /api/v1/tenants/{id}. An unauthenticated attacker could create an account, obtain an authentication token, and then use that token to perform administrative actions on any tenant in the system by simply specifying the tenant's ID in the API request. The patch was not found in the commits between v0.3.0 and v0.3.1 as suggested by the advisory, but was identified in a separate commit that was part of a different release, which adds the necessary authorization middleware and checks to these handlers.

Vulnerable functions

handler.GetTenant

internal/http/handler/tenant_handler.go

This function handles `GET /api/v1/tenants/{id}`. It retrieves tenant information by ID from the URL path without validating if the user making the request is authorized to view the specified tenant. This allows any authenticated user to view the details of any tenant.

handler.UpdateTenant

internal/http/handler/tenant_handler.go

This function handles `PUT /api/v1/tenants/{id}`. It allows an authenticated user to update the information of any tenant by providing their ID in the URL, without checking for ownership or administrative rights. This could lead to an account takeover by, for example, changing the tenant's name or other settings.

handler.DeleteTenant

internal/http/handler/tenant_handler.go

This function handles `DELETE /api/v1/tenants/{id}`. It allows any authenticated user to delete any tenant by their ID without proper authorization checks. This can lead to the destruction of other users' data and workspaces.

handler.ListTenants

internal/http/handler/tenant_handler.go

This function handles `GET /api/v1/tenants`. It lists all tenants in the system to any authenticated user, exposing sensitive information like tenant names and IDs, which could then be used to target specific tenants with other attacks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.