EUVD-2026-71127
GHSA-mq4x-r3rg-g5rq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed QAnything instance
-
DeliveryQuery unauthenticated endpoints to enumerate file IDs
-
ExploitRequest get_file_base64 or get_doc without credentials
-
ExecutionServer returns full document content
-
PersistDecode base64 to recover plaintext files
-
ImpactRepeat across all enumerated IDs for full corpus extraction
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for exploitation. The CVSS 4.0 vector confirms AV:N/AC:L/AT:N/PR:N/UI:N - the vulnerable endpoints are accessible over the network, require no authentication, no prior setup, and no user interaction. The only practical prerequisite is network reachability to the QAnything HTTP API, which is likely satisfied in any default deployment. Exploitation is compounded by the availability of file identifiers through other unauthenticated API routes, enabling enumeration without any insider knowledge. The cross-tenant impact applies specifically to multi-user deployments where separate tenants upload documents to isolated knowledge bases. |
| Impact | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N accurately reflects the threat model: network-reachable, zero-barrier, confidentiality-only impact. There is no integrity or availability component, which correctly limits the score from the maximum. The attack complexity is genuinely low because file identifiers are exposed through other unauthenticated endpoints, enabling automated enumeration. No CISA KEV entry exists and no standalone exploit code has been identified at time of analysis, but the technique is trivially reproducible from the description alone - essentially a missing auth check on a REST endpoint, requiring only an HTTP client. EPSS data is not included in the input; however, given the triviality of exploitation and multi-tenant nature of the product (cross-tenant data access), real-world risk is elevated for any internet-facing or shared QAnything deployment. The absence of patch version data in the available intelligence is a meaningful gap and limits remediation precision. |
| Exploit ScenarioDerived | An unauthenticated external attacker sends HTTP requests to the /api/local_doc_qa/get_file_base64 endpoint against an internet-facing QAnything 2.0.0 instance, iterating over file identifiers discovered via other open endpoints. For each valid ID, the server returns the full base64-encoded document content without verifying the requester's identity or tenancy, allowing systematic extraction of all knowledge-base documents across all users. No credentials, session tokens, or special tooling are required beyond a standard HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Unauthenticated cross-tenant document disclosure in QAnything 2.0.0 allows any network attacker to retrieve base64-encoded files or parsed document chunks from any knowledge base without credentials or ownership verification. The /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints lack authentication guards entirely (CWE-306), and file identifiers can be enumerated via separate unauthenticated endpoints, making full corpus extraction feasible. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no technical sophistication.
RemediationAI
No vendor-released patched version has been independently confirmed from the available references at time of analysis. The VulnCheck advisory at https://www.vulncheck.com/advisories/qanything-2.0.0-unauthenticated-cross-user-file-disclosure should be monitored for patch availability. As immediate compensating controls: restrict network access to the QAnything API surface using a reverse proxy or firewall so only authenticated internal clients can reach /api/local_doc_qa/* endpoints - this eliminates the internet-facing attack surface without requiring application changes. Alternatively, deploy an authentication gateway (e.g., OAuth2 proxy) in front of the service to enforce credential checks before requests reach handler.py. Operators running multi-tenant deployments should audit access logs for anomalous enumeration patterns against the get_file_base64 and get_doc endpoints. Do not expose QAnything directly to untrusted networks until a patched release is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
QAnything is an open-source RAG (Retrieval-Augmented Generation) knowledge base system developed by Netease Youdao, designed for multi-tenant document ingestion, chunking, and Q&A over uploaded content. The affected version is 2.0.0 (CPE: cpe:2.3:a:netease-youdao:qanything:*:*:*:*:*:*:*:*). The vulnerability resides in qanything_kernel/qanything_server/handler.py, where the two document-retrieval handlers are registered without requiring any authentication middleware or session token validation. CWE-306 (Missing Authentication for Critical Function) is the root cause: the application exposes sensitive data-retrieval routes on the same HTTP API surface as public routes but fails to apply an authentication check. Because file identifiers can be gleaned from unauthenticated listing or creation endpoints, an attacker can perform systematic enumeration and then harvest all stored knowledge-base content across all tenants.
Know when Qanything gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable with no auth or complexity; pure confidentiality impact, no integrity or availability effect; no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and retrieve base64-encoded files or parsed document chunks without ownership verification to disclose cross-tenant knowledge base content.
Executive ViewAI
QAnything 2.0.0 exposes confidential documents stored in knowledge bases to any network attacker without requiring authentication or credentials. Organizations using this platform-whether for internal repositories, customer data, or proprietary knowledge-face immediate risk of unauthorized information disclosure. This vulnerability requires urgent action to isolate affected systems and prevent data compromise.
Restrict network access to QAnything 2.0.0 instances via IP whitelisting or VPN-only access; do not expose to public networks. Deploy Web Application Firewall rules to block the vulnerable API endpoints. Disable /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints if not operationally required. Implement and monitor comprehensive API access logging to detect unauthorized document retrieval attempts. Segregate affected instances on isolated network segments. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistenci
netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenat
A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9
A Denial of Service (DoS) vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2
A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. Rated high severity (CVSS 7.5),
A stored Cross-Site Scripting (XSS) vulnerability exists in netease-youdao/QAnything. Rated medium severity (CVSS 6.1),
qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection. R
A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. Rated high severity (CVSS 7.5),
Exploit-DB