AstronRPA CVE-2026-108547

Exploitation requires a valid authenticated account (any low-privilege tenant user) on a multi-tenant AstronRPA deployment (version through 1.1.6) with network access to the robot-service get-batch-shared-var endpoint, plus the presence of 'all-users'/shared variables that the service re-encrypts with the caller's tenant key. The attacker must enumerate sequential shared variable IDs, which is feasible precisely because the IDs are predictable and sequential. Limiting factors: a working authenticated session is mandatory (PR:L, not unauthenticated), the instance must be operated in a shared multi-tenant mode holding other tenants' secrets, and only confidentiality is affected - no write or availability impact.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) scores 7.1 (High) and is internally consistent with the description: a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privilege account (PR:L) and yields only confidentiality impact (VC:H, with VI/VA:N). No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The confidentiality impact is the aggravating factor - cross-tenant recovery of other tenants' credentials in plaintext is high-value and can enable lateral movement - but the authentication requirement and the niche deployment footprint of the product substantially limit real-world scale. Net: real and worth remediating in multi-tenant AstronRPA deployments, but not a drop-everything issue driven by widespread exploitation. Note a tagging caveat: the input tag 'Authentication Bypass' is imprecise - CWE-639 and the description describe a missing tenant authorization/IDOR check affecting already-authenticated users, not an authentication bypass.

An authenticated low-privilege user of one tenant on a shared AstronRPA instance calls the get-batch-shared-var endpoint and iterates over sequential shared variable IDs belonging to other tenants. Because the robot-service omits a tenant authorization check and re-encrypts all-users variables under the caller's own tenant key, the attacker decrypts and reads other tenants' stored credentials in plaintext. No public exploit code was identified at time of analysis, but the attack is trivial to script given the sequential IDs and low complexity.