CVE-2026-111694 in qKnow
Summary
by MITRE • 10/16/2026
qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in qKnow through version 2.4.3 represents a critical failure in access control mechanisms, specifically categorized under CWE-287 as Improper Authentication. This flaw allows unauthenticated remote attackers to interact with specific workflow integration endpoints that are exposed via the application's security configuration file, known as SecurityConfig. The core issue lies in the misconfiguration of these endpoints, which fail to enforce mandatory authentication checks before processing incoming requests. Consequently, any entity on the network or internet can invoke these API methods without providing valid credentials, bypassing the intended security perimeter entirely.
The operational impact of this vulnerability is significant due to its potential for information disclosure and enumeration attacks. Attackers can exploit this lack of authentication by sending POST requests with sequential userId values to the /flyflow/userById endpoint. This technique allows them to iterate through user identifiers systematically, extracting sensitive personal data such as phone numbers associated with each account. Additionally, attackers can invoke the roleAll method to retrieve a comprehensive list of all roles defined within the system, and call deptListByParentDeptId to map out the entire organizational department structure. These actions collectively enable an adversary to build a detailed profile of the organization's personnel hierarchy and access levels without any prior authorization.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Discovery, specifically T1087 which covers Account Enumeration, as well as potential reconnaissance activities that precede more severe attacks like privilege escalation or targeted phishing campaigns. The exposure of phone numbers and role assignments provides attackers with valuable intelligence for social engineering efforts, allowing them to craft highly convincing spear-phishing messages tailored to specific individuals based on their detected roles within the organization. Furthermore, understanding the departmental structure aids in identifying high-value targets such as administrators or executives who may hold elevated privileges.
To mitigate this vulnerability, immediate remediation steps should focus on correcting the SecurityConfig settings to ensure that all workflow integration endpoints require valid authentication tokens before processing requests. It is essential to implement robust access control checks that verify both user identity and authorization levels for every API call. Additionally, implementing rate limiting and input validation can help detect and prevent automated enumeration attempts. Organizations should also conduct a thorough audit of their security configurations to ensure no other endpoints are similarly exposed without proper authentication controls. Regular penetration testing and code reviews focusing on access control logic will further strengthen the application's resilience against such misconfigurations.