Submeter #812172: Tencent WeKnora <= v0.3.6 Insecure Direct Object Reference (CWE-639)

# Technical Details
A critical Insecure Direct Object Reference (IDOR) vulnerability exists in the `getKnowledgeBaseForInitialization` method in `internal/handler/initialization.go` of WeKnora.

The application fails to validate whether the retrieved Knowledge Base entity belongs to the active request's `TenantID` during unauthenticated object-level retrieval.

# Vulnerable Code
File: internal/handler/initialization.go
Method: getKnowledgeBaseForInitialization
Why: It fetches the requested Knowledge Base purely by its globally unique `kbId` and completely fails to validate whether the retrieved entity belongs to the active request's `TenantID` when returning data for updates.

# Reproduction
1. Register a victim user A and create a Knowledge Base.
2. Register an attacker user B and create fake LLM and Embedding models within their own tenant environment to satisfy backend validation.
3. Attacker user B successfully reads the victim's Knowledge Base config via `/initialization/config/:kbId`.
4. Attacker user B updates the victim's Knowledge Base config passing the fake model IDs, bypassing access boundary checks and modifying the internal chunk size exclusively.

# Impact
- Unauthorized cross-tenant data access, compromising the privacy and operational configurations of victims' Knowledge Bases.
- Unauthorized write capability permits an attacker to alter the extraction strategies, LLM bindings, and document chunking sizes, resulting in logical compromise and context tampering across tenant boundaries.

• Fonte: ⚠️ https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b
• Utilizador: Eric-z (UID 95890)
• Submissão: 24/04/2026 13h42 (há 1 mês)
• Moderação: 17/05/2026 12h23 (23 days later)
• Estado: Aceite
• Entrada VulDB: 364410 [Tencent WeKnora até 0.3.6 Config API Endpoint initialization.go getKnowledgeBaseForInitialization kbId Elevação de Privilégios]
• Pontos: 20