Qknow
Monthly
Unauthenticated remote attackers can enumerate sensitive user directory information-including phone numbers, roles, and department structure-from qKnow through version 2.4.3 by directly calling /flyflow workflow integration endpoints that are mistakenly permitted without authentication in the shipped SecurityConfig. The affected endpoints are /flyflow/userById (which accepts sequential userId values), roleAll, and deptListByParentDeptId; exploitation requires only network reachability of the qKnow instance, with no credentials or user interaction. The flaw is rated CVSS 6.9 (CVSS 4.0) and CWE-306, but the impact is limited to read-only information disclosure; no write, modification, or code execution is possible. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can enumerate sensitive user directory information-including phone numbers, roles, and department structure-from qKnow through version 2.4.3 by directly calling /flyflow workflow integration endpoints that are mistakenly permitted without authentication in the shipped SecurityConfig. The affected endpoints are /flyflow/userById (which accepts sequential userId values), roleAll, and deptListByParentDeptId; exploitation requires only network reachability of the qKnow instance, with no credentials or user interaction. The flaw is rated CVSS 6.9 (CVSS 4.0) and CWE-306, but the impact is limited to read-only information disclosure; no write, modification, or code execution is possible. No public exploit code or confirmed active exploitation has been identified at time of analysis.