제출 #812172: Tencent WeKnora <= v0.3.6 Insecure Direct Object Reference (CWE-639)

# Technical Details
A critical Insecure Direct Object Reference (IDOR) vulnerability exists in the `getKnowledgeBaseForInitialization` method in `internal/handler/initialization.go` of WeKnora.

The application fails to validate whether the retrieved Knowledge Base entity belongs to the active request's `TenantID` during unauthenticated object-level retrieval.

# Vulnerable Code
File: internal/handler/initialization.go
Method: getKnowledgeBaseForInitialization
Why: It fetches the requested Knowledge Base purely by its globally unique `kbId` and completely fails to validate whether the retrieved entity belongs to the active request's `TenantID` when returning data for updates.

# Reproduction
1. Register a victim user A and create a Knowledge Base.
2. Register an attacker user B and create fake LLM and Embedding models within their own tenant environment to satisfy backend validation.
3. Attacker user B successfully reads the victim's Knowledge Base config via `/initialization/config/:kbId`.
4. Attacker user B updates the victim's Knowledge Base config passing the fake model IDs, bypassing access boundary checks and modifying the internal chunk size exclusively.

# Impact
- Unauthorized cross-tenant data access, compromising the privacy and operational configurations of victims' Knowledge Bases.
- Unauthorized write capability permits an attacker to alter the extraction strategies, LLM bindings, and document chunking sizes, resulting in logical compromise and context tampering across tenant boundaries.

• 원천: ⚠️ https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b
• 사용자: Eric-z (UID 95890)
• 제출: 2026. 04. 24. PM 01:42 (2 개월 ago)
• 모더레이션: 2026. 05. 17. PM 12:23 (23 days later)
• 상태: 수락
• VulDB 항목: 364410 [Tencent WeKnora 까지 0.3.6 Config API Endpoint initialization.go getKnowledgeBaseForInitialization kbId 권한 상승]
• 포인트들: 20