Medium severity · published May 18, 2026
CVE-2026-8786
Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
WeKnora · Tencent
0.3.0; 0.3.1; 0.3.2; 0.3.3; 0.3.4; 0.3.5; +1 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8786
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8786
Exploit
https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b
Exploit
https://vuldb.com/submit/812172
Third Party Advisory
https://vuldb.com/vuln/364410
Permissions Required
https://vuldb.com/vuln/364410/cti
More from WeKnora
9.8
CVE-2026-30860
WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool
9.8
CVE-2026-22687
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval
9.8
CVE-2025-11046
A security flaw has been discovered in Tencent WeKnora 0.1.0
8.8
CVE-2026-30861
WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation
8.8
CVE-2026-30855
WeKnora: Broken Access Control in Tenant Management