qKnow CVE-2026-111694

Exploitation requires only that the qKnow (through 2.4.3) /flyflow workflow integration endpoints - specifically /flyflow/userById, roleAll, and deptListByParentDeptId - be network-reachable by the attacker; these are exposed without authentication by the product's shipped SecurityConfig, so no special or non-default configuration is needed. The only practical limiting factor is network exposure of the instance; there is no required authentication, user interaction, or privilege. Impact is bounded to read-only disclosure of user directory data (phone numbers, roles, department hierarchy) - no write, modification, or code execution is possible through this flaw.

All available signals point to an easy-to-trigger but limited-impact information-disclosure flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a fully remote, unauthenticated, low-complexity attack with no user interaction, and the CWE-306 (Missing Authentication) classification is consistent with the description: SecurityConfig permits /flyflow endpoints without authentication. However, impact is deliberately narrow - only VC:L (limited confidentiality) with VI:N and VA:N, meaning no integrity or availability impact and no code execution, yielding a medium 6.9 score rather than a critical one. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so there is no confirmed-exploitation or exploitation-probability signal to weigh; a public technical writeup (hackmd) documenting the endpoints and enumeration method does exist among the references, which lowers the bar for opportunistic abuse even without weaponized exploit code. Net assessment: this is a genuine, trivially exploitable PII/directory-enumeration issue (user phone numbers, roles, department structure) but not a remote-code-execution emergency - prioritize based on whether qKnow instances are internet-exposed, not on raw severity. No signals are directly conflicting; the main gap is the absence of EPSS/KEV data to gauge real-world exploitation volume.

A remote attacker who can reach a qKnow instance sends unauthenticated POST requests to /flyflow/userById, incrementing the userId parameter sequentially, and also calls roleAll and deptListByParentDeptId. Because these endpoints are explicitly permitted without authentication in SecurityConfig, the attacker harvests the full user directory - phone numbers, role assignments, and the organizational department tree - without credentials or user interaction. A public technical writeup describing this exact method exists among the references, though no weaponized exploit tool is confirmed in the provided data.