Enviar #812172: Tencent WeKnora <= v0.3.6 Insecure Direct Object Reference (CWE-639)

# Technical Details
A critical Insecure Direct Object Reference (IDOR) vulnerability exists in the `getKnowledgeBaseForInitialization` method in `internal/handler/initialization.go` of WeKnora.

The application fails to validate whether the retrieved Knowledge Base entity belongs to the active request's `TenantID` during unauthenticated object-level retrieval.

# Vulnerable Code
File: internal/handler/initialization.go
Method: getKnowledgeBaseForInitialization
Why: It fetches the requested Knowledge Base purely by its globally unique `kbId` and completely fails to validate whether the retrieved entity belongs to the active request's `TenantID` when returning data for updates.

# Reproduction
1. Register a victim user A and create a Knowledge Base.
2. Register an attacker user B and create fake LLM and Embedding models within their own tenant environment to satisfy backend validation.
3. Attacker user B successfully reads the victim's Knowledge Base config via `/initialization/config/:kbId`.
4. Attacker user B updates the victim's Knowledge Base config passing the fake model IDs, bypassing access boundary checks and modifying the internal chunk size exclusively.

# Impact
- Unauthorized cross-tenant data access, compromising the privacy and operational configurations of victims' Knowledge Bases.
- Unauthorized write capability permits an attacker to alter the extraction strategies, LLM bindings, and document chunking sizes, resulting in logical compromise and context tampering across tenant boundaries.

• Fuente: ⚠️ https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b
• Usuario: Eric-z (UID 95890)
• Sumisión: 2026-04-24 13:42 (hace 1 mes)
• Moderación: 2026-05-17 12:23 (23 days later)
• Estado: Aceptado
• Entrada de VulDB: 364410 [Tencent WeKnora hasta 0.3.6 Config API Endpoint initialization.go getKnowledgeBaseForInitialization kbId escalada de privilegios]
• Puntos: 20