Soumettre #812172: Tencent WeKnora <= v0.3.6 Insecure Direct Object Reference (CWE-639)

# Technical Details
A critical Insecure Direct Object Reference (IDOR) vulnerability exists in the `getKnowledgeBaseForInitialization` method in `internal/handler/initialization.go` of WeKnora.

The application fails to validate whether the retrieved Knowledge Base entity belongs to the active request's `TenantID` during unauthenticated object-level retrieval.

# Vulnerable Code
File: internal/handler/initialization.go
Method: getKnowledgeBaseForInitialization
Why: It fetches the requested Knowledge Base purely by its globally unique `kbId` and completely fails to validate whether the retrieved entity belongs to the active request's `TenantID` when returning data for updates.

# Reproduction
1. Register a victim user A and create a Knowledge Base.
2. Register an attacker user B and create fake LLM and Embedding models within their own tenant environment to satisfy backend validation.
3. Attacker user B successfully reads the victim's Knowledge Base config via `/initialization/config/:kbId`.
4. Attacker user B updates the victim's Knowledge Base config passing the fake model IDs, bypassing access boundary checks and modifying the internal chunk size exclusively.

# Impact
- Unauthorized cross-tenant data access, compromising the privacy and operational configurations of victims' Knowledge Bases.
- Unauthorized write capability permits an attacker to alter the extraction strategies, LLM bindings, and document chunking sizes, resulting in logical compromise and context tampering across tenant boundaries.

• La source: ⚠️ https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b
• Utilisateur: Eric-z (UID 95890)
• Soumission: 24/04/2026 13:42 (il y a 1 mois)
• Modérer: 17/05/2026 12:23 (23 days later)
• Statut: Accepté
• Entrée VulDB: 364410 [Tencent WeKnora jusqu’à 0.3.6 Config API Endpoint initialization.go getKnowledgeBaseForInitialization kbId élévation de privilèges]
• Points: 20