EUVD-2026-102503

BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary fileid values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/filebbox to...

CVE-2026-111363

BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary fileid values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/filebbox to...

CVE-2026-111363

The BISHENG platform, up to version 3.0.0-beta4 , is vulnerable to an Insecure Direct Object Reference (IDOR) (CWE-639) in the /api/v1/knowledge/file_bbox endpoint. This flaw allows authenticated low-privileged users to access and read parsed documents belonging to other users or tenants by provi...

CVE-2026-111363 BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox

BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary fileid values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/filebbox to...