CVE-2026-30857General(tencent / weknora)

LOWCVSS 5.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a cross-tenant authorization bypass in the knowledge base copy endpoint allows any authenticated user to clone (duplicate) another tenant’s knowledge base into their own tenant by knowing/guessing the source knowledge base ID. This enables bulk data exfiltration (document/FAQ content) across tenants. This issue has been patched in version 0.3.0.

tencent CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/Tencent/WeKnora/security/advisories/GHSA-8rf9-c59g-f82f

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

weknora

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 3 signals
General: 2 classified signals
Disclosure: 1 classified signal
3 total mentions across 1 day

Affected systems

Vendors

tencent

Products

weknora

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

General

266.7%

Disclosure

133.3%

Referenced assets4 URLs

By indicator

Full discourse3 posts

Vulmon Vulnerability Feed@VulmonFeeds215d
General
CVE-2026-30857 Cross-Tenant Authorization Bypass in WeKnora Knowledge Base Copy ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30857 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The tweet announces CVE-2026-30857, notes a Cross‑Tenant Authorization Bypass in WeKnora Knowledge Base, and links to a vulnerability details page, but provides no deeper technical or exploit information.
0001062
4.0K followersView on X
CVE@CVEnew215d
Disclosure
CVE-2026-30857 WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a cross-tenant authorization bypass in th… https://www.cve.org/CVERecord?id=CVE-2026-30857
Post summary
The tweet announces CVE-2026-30857, describing a cross‑tenant authorization bypass in WeKnora before v0.3.0, without providing PoC code, exploit details, or patch information.
0000076
56.6K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash215d
General
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-30857 - WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning Intel Report: https://ift.tt/L5kKsmJ
Post summary
An alert regarding CVE‑2026‑30857 – an unauthorized cross‑tenant knowledge base cloning issue – is issued with a link to an Intel report, but the post lacks any proof‑of‑concept, exploit code, patch, or evidence of active exploitation.
0000025
344 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	tencent	weknora	-	-	-

Explore more

Back to dashboard tencent CVEs weknora vulnerabilities

What researchers are saying

CVE-2026-30857

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The tweet announces CVE-2026-30857, notes a Cross‑Tenant Authorization Bypass in WeKnora Knowledge Base, and links to a vulnerability details page, but provides no deeper technical or exploit information.

CVE@CVEnewDisclosure

The tweet announces CVE-2026-30857, describing a cross‑tenant authorization bypass in WeKnora before v0.3.0, without providing PoC code, exploit details, or patch information.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashGeneral

An alert regarding CVE‑2026‑30857 – an unauthorized cross‑tenant knowledge base cloning issue – is issued with a link to an Intel report, but the post lacks any proof‑of‑concept, exploit code, patch, or evidence of active exploitation.