CVE-2026-30857

Executive Summary

CVE-2026-30857 is a cross-tenant authorization bypass vulnerability in WeKnora, an LLM-powered framework for deep document understanding and semantic retrieval. The flaw resides in the knowledge base copy endpoint, allowing any authenticated user to clone (duplicate) another tenant’s knowledge base into their own tenant by simply knowing or guessing the source knowledge base ID. This enables bulk data exfiltration of document and FAQ content across tenants. The vulnerability has been patched in version 0.3.0. The CVSS score is 5.3 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

WeKnora is a Python-based framework. Organizations using WeKnora should verify their dependency version and ensure they are not using a vulnerable version (< 0.3.0). The package is likely distributed via PyPI or GitHub. Supply chain security is critical as this vulnerability allows tenant data exfiltration.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker must be authenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – unauthorized data duplication.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The vulnerability requires authentication but allows cross-tenant data exfiltration. The low EPSS score suggests limited active exploitation, but the impact on multi-tenant environments is significant.

Deep Dive & Mechanics

The vulnerability exists in the knowledge base copy endpoint of WeKnora. This endpoint is designed to allow a user to copy a knowledge base from one tenant to another. However, the authorization check is insufficient. The endpoint only verifies that the user is authenticated but does not verify that the user belongs to the source tenant. By providing a valid source knowledge base ID (which may be guessable or enumerable), an attacker can clone any knowledge base into their own tenant.

Root Cause: Missing or improper authorization check on the source knowledge base ID. The endpoint likely uses a function like copy_knowledge_base(source_kb_id, target_tenant_id) without verifying that the requesting user has access to the source knowledge base.

Attack Flow:

1. Attacker authenticates to WeKnora.
2. Attacker identifies or guesses a knowledge base ID belonging to another tenant (e.g., via enumeration or known patterns).
3. Attacker sends a request to the copy endpoint with the source knowledge base ID and their own tenant ID.
4. The system clones the knowledge base (including documents and FAQs) into the attacker’s tenant.
5. Attacker accesses the cloned knowledge base and exfiltrates the data.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.3.0):

@app.route('/api/knowledge_base/copy', methods=['POST'])
@login_required
def copy_knowledge_base():
    data = request.get_json()
    source_kb_id = data['source_kb_id']
    target_tenant_id = current_user.tenant_id
    # Missing authorization check on source_kb_id
    kb = KnowledgeBase.query.get(source_kb_id)
    if not kb:
        return jsonify({'error': 'Knowledge base not found'}), 404
    new_kb = kb.clone(target_tenant_id)
    db.session.add(new_kb)
    db.session.commit()
    return jsonify({'message': 'Knowledge base copied', 'kb_id': new_kb.id}), 200

Patched Code (0.3.0+):

@app.route('/api/knowledge_base/copy', methods=['POST'])
@login_required
def copy_knowledge_base():
    data = request.get_json()
    source_kb_id = data['source_kb_id']
    target_tenant_id = current_user.tenant_id
    # Authorization check: user must belong to the source tenant
    source_kb = KnowledgeBase.query.get(source_kb_id)
    if not source_kb:
        return jsonify({'error': 'Knowledge base not found'}), 404
    if source_kb.tenant_id != current_user.tenant_id:
        return jsonify({'error': 'Unauthorized'}), 403
    new_kb = source_kb.clone(target_tenant_id)
    db.session.add(new_kb)
    db.session.commit()
    return jsonify({'message': 'Knowledge base copied', 'kb_id': new_kb.id}), 200

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy WeKnora version 0.2.9 (vulnerable) in a Docker container.
2. Create two tenants: Tenant A (attacker) and Tenant B (victim).
3. In Tenant B, create a knowledge base with sensitive documents.
4. Authenticate as Tenant A user.

Exploitation Steps:

1. Enumerate knowledge base IDs (e.g., by observing patterns or brute-forcing).
2. Send a POST request to /api/knowledge_base/copy with the source knowledge base ID from Tenant B.
3. Verify the knowledge base appears in Tenant A.

Example Request:

curl -X POST https://target-weknora/api/knowledge_base/copy \
  -H "Authorization: Bearer <attacker_token>" \
  -H "Content-Type: application/json" \
  -d '{"source_kb_id": "kb_tenant_b_12345"}'

Expected Response:

{"message": "Knowledge base copied", "kb_id": "kb_tenant_a_new_id"}

Blue Team

Detection:

• Monitor for multiple copy requests from the same user to different knowledge base IDs.
• Alert on copy requests where the source knowledge base ID does not match the user's tenant.
• Log all copy operations and correlate with tenant membership.

Hunting:

• Search for logs containing copy_knowledge_base endpoint calls.
• Look for anomalies in the source_kb_id parameter (e.g., IDs from other tenants).
• Review access logs for patterns of ID enumeration (e.g., sequential IDs).

Indicators of Compromise (IOCs)

• Network: POST requests to /api/knowledge_base/copy with source_kb_id values not belonging to the requester's tenant.
• Logs: Entries showing successful copy operations where source_kb_id tenant does not match target_tenant_id.
• System: Unexpected knowledge bases appearing in a tenant that were not created by the tenant's users.
• File: No specific file IOCs; this is an API-level vulnerability.

Detection Engineering

YARA Rule

rule CVE_2026_30857_WeKnora_CrossTenantCopy {
    meta:
        description = "Detects exploitation attempts of CVE-2026-30857 in WeKnora logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-30857"
    strings:
        $s1 = "/api/knowledge_base/copy" ascii wide nocase
        $s2 = "source_kb_id" ascii wide nocase
        $s3 = "target_tenant_id" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: WeKnora Cross-Tenant Knowledge Base Copy Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to copy a knowledge base across tenants in WeKnora
author: Valters IT
date: 2026-01-01
logsource:
    category: application
    product: weknora
detection:
    selection:
        endpoint: "/api/knowledge_base/copy"
        method: "POST"
    condition: selection
falsepositives:
    - Legitimate cross-tenant copy operations (if allowed by policy)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2026-30857 WeKnora Cross-Tenant Knowledge Base Copy Attempt";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/api/knowledge_base/copy";
    http_uri;
    content:"source_kb_id";
    http_client_body;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade WeKnora to version 0.3.0 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests to /api/knowledge_base/copy with suspicious source_kb_id patterns.

Long-term:

• Enforce strict authorization checks on all API endpoints that access resources by ID.
• Implement tenant isolation at the database level.
• Conduct regular security audits of multi-tenant applications.
• Monitor for unusual API usage patterns.

Workaround:

• Disable the knowledge base copy endpoint if not needed.
• Restrict API access to trusted IPs or networks.

Valters IT