iFlytek astron-agent CVE-2026-116340

Requires a valid authenticated low-privilege account on the astron-agent Console (PR:L) - not anonymous/unauthenticated access. The concrete trigger is manipulation of the space-id argument passed to the Console Knowledge-List endpoint (FileInfoV2Service.listKnowledgeByPage), causing the service to return knowledge-list data for a space the caller is not authorized to view. Affected deployments are astron-agent versions up to and including 1.1.2. Limiting factors: an authenticated session is mandatory, impact is confined to confidentiality of knowledge-list data (no integrity or availability impact per VI:N/VA:N), and no vendor-confirmed fixed version is available. The precise authorization check that fails is not detailed beyond the user-controlled space-id key in the available sources.

This is a low-severity, authenticated insecure-direct-object-reference (CWE-639) flaw, and the signals are consistent rather than conflicting: the input CVSS 4.0 base score is 2.1 and the vector requires privileges (PR:L), so exploitation presumes an already-authenticated low-privilege account, not an anonymous attacker. The vuln.today decision label is 'monitor' - the lowest urgency tier - and the issue is NOT in CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists (a Python script on GitHub) but it is not verified as working exploit code, and PoC availability is distinct from active exploitation. No EPSS score was provided in the input, so real-world exploitation probability cannot be quantified from this data. Impact is confidentiality-only and rated Low (VC:L, with VI:N/VA:N), meaning an attacker can read knowledge-list data belonging to other spaces/tenants but cannot modify or destroy it. The most notable risk-aggravating factor is non-technical: the vendor was contacted but did not respond, so no coordinated fix or advisory is confirmed. Net: this is a genuine but low-priority authorization/multi-tenancy data-exposure bug, not a high-urgency item; prioritize it according to how sensitive the knowledge-base contents are in a given deployment.

A low-privilege but authenticated user of the astron-agent Console tampers with the space-id argument sent to the Knowledge-List endpoint (FileInfoV2Service.listKnowledgeByPage), causing the service to return knowledge entries belonging to a space the user does not own - a classic multi-tenant authorization bypass. A public PoC reference (v2_knowledge_space_id_bypass.py) exists but is not verified as working exploit code. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, the attack is remote and low-complexity but still requires a valid authenticated session.