CVE-2026-111363: falha de alta gravidade em dataelement bisheng
BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
dataelement · bishengCVEs relacionadas — dataelement bisheng
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/dataelement/bishenghttps://github.com/dataelement/bisheng/blob/v3.0.0-beta4/src/backend/bisheng/knowledge/api/endpoints/knowledge.py#L663-L670https://github.com/dataelement/bisheng/blob/v3.0.0-beta4/src/backend/bisheng/knowledge/domain/services/knowledge_service.py#L2523-L2533https://hackmd.io/@hieuPenguinnn/bisheng-knowledge-file-bbox-cross-user-idorhttps://www.vulncheck.com/advisories/bisheng-through-3.0.0-beta4-idor-via-api-v1-knowledge-file-bbox