CVE-2026-116340

A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The...

CVE-2026-116339

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/execddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been...

CVE-2026-116340 iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization

A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The...

EUVD-2026-109946

A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The...

CVE-2026-116340

A vulnerability exists in iFlytek astron-agent up to version 1.1.2 affecting the Console Knowledge-List Endpoint . Specifically, the FileInfoV2Service.listKnowledgeByPage function within FileInfoV2Service.java is susceptible to an authorization bypass caused by the manipulation of the space-id ar...

CVE-2026-116340 iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization

A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The...

CVE-2026-116339

A vulnerability exists in iFlytek astron-agent (up to version 1.1.2 ) within the DDL Whitelist Handler component. The issue is located in the file core/memory/database/api/v1/exec_ddl.py, where an unknown function allows for an incomplete blacklist manipulation. This flaw can be triggered via a r...

CVE-2026-116339 iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/execddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been...

CVE-2026-116339 iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/execddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been...

EUVD-2026-109940

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/execddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been...

PT-2026-123350

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has bee...

PT-2026-123351

A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The...

iFLYTEK Astron Agent input validation error vulnerability

Versions 1.1.2 and earlier of iFLYTEK Astron Agent contain an input validation error vulnerability. This vulnerability stems from an incomplete blacklist issue involving an unknown function in the file core/memory/database/api/v1/execddl.py within the DDL Whitelist Handler component. It may allow...

iFLYTEK Astron Agent authorization issue vulnerability

Versions 1.1.2 and earlier of iFLYTEK Astron Agent contain an authorization vulnerability. This vulnerability stems from improper handling of the “space-id” parameter in the FileInfoV2Service.listKnowledgeByPage function within the FileInfoV2Service.java file in the Console Knowledge-List Endpoin...

CVE-2026-108864

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...

EUVD-2026-97015

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...

CVE-2026-108864 iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...

CVE-2026-108864

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...

CVE-2026-108864

The iFlytek Astron Agent (through version 1.1.2 ) is vulnerable to an insecure direct object reference (IDOR) in the POST /workflow/v1/resume endpoint. This flaw allows authenticated applications to resume paused workflows belonging to other applications by supplying a predictable Snowflake event...

CVE-2026-108864 iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...