Tencent WeKnora CVE-2026-8786

Exploitation requires the attacker to possess valid authenticated credentials with low-privilege access (PR:L) to the WeKnora instance. The Config API endpoint must be network-accessible to the attacker (AV:N), which is the default deployment configuration for WeKnora's API services. No specific non-default configuration, feature enablement, or user interaction (UI:N) is required. Attack complexity is low (AC:L), meaning standard knowledge of HTTP API interaction and the publicly available exploit code are sufficient. The vulnerability is exploitable against default installations of WeKnora versions up to 0.3.6 where the initialization endpoint is enabled. Limiting factors include the authentication requirement, which prevents fully unauthenticated internet-wide exploitation, and the unchanged scope (S:U), meaning attackers cannot pivot beyond the WeKnora application's authorization context to underlying systems.

Real-world risk is moderate with elevated exploitation potential. CVSS 6.3 accurately reflects the threat: network-accessible (AV:N) with low attack complexity (AC:L) requiring only low-privilege authentication (PR:L) and no user interaction (UI:N). Impact is limited to low confidentiality, integrity, and availability compromise (C:L/I:L/A:L) with unchanged scope (S:U). The Exploit Maturity indicator shows proof-of-concept exists (E:P), confirmed by the public GitHub Gist containing working exploit code. However, CVSS Remediation Level is undefined (RL:X), and vendor non-responsiveness signals no imminent patch. Without EPSS scores or CISA KEV listing, widespread exploitation is not confirmed, but the public POC combined with network accessibility creates actionable risk for organizations running WeKnora. The requirement for authenticated access (PR:L) reduces immediate internet-wide scanning risk but enables insider threats or attacks following initial compromise. Priority should be medium-high for organizations using WeKnora, especially in multi-tenant deployments where authorization boundaries are critical.

An authenticated attacker with low-privilege credentials to a WeKnora instance crafts HTTP requests to the Config API endpoint, manipulating the kbId parameter in calls to getKnowledgeBaseForInitialization. By enumerating or guessing knowledge base identifiers, the attacker bypasses authorization checks and retrieves initialization data from knowledge bases they should not access, potentially exposing sensitive organizational knowledge, modifying configurations, or disrupting service availability. The public GitHub Gist exploit code at gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b provides working proof-of-concept, lowering the technical barrier for exploitation.