提交 #812172: Tencent WeKnora <= v0.3.6 Insecure Direct Object Reference (CWE-639)

# Technical Details
A critical Insecure Direct Object Reference (IDOR) vulnerability exists in the `getKnowledgeBaseForInitialization` method in `internal/handler/initialization.go` of WeKnora.

The application fails to validate whether the retrieved Knowledge Base entity belongs to the active request's `TenantID` during unauthenticated object-level retrieval.

# Vulnerable Code
File: internal/handler/initialization.go
Method: getKnowledgeBaseForInitialization
Why: It fetches the requested Knowledge Base purely by its globally unique `kbId` and completely fails to validate whether the retrieved entity belongs to the active request's `TenantID` when returning data for updates.

# Reproduction
1. Register a victim user A and create a Knowledge Base.
2. Register an attacker user B and create fake LLM and Embedding models within their own tenant environment to satisfy backend validation.
3. Attacker user B successfully reads the victim's Knowledge Base config via `/initialization/config/:kbId`.
4. Attacker user B updates the victim's Knowledge Base config passing the fake model IDs, bypassing access boundary checks and modifying the internal chunk size exclusively.

# Impact
- Unauthorized cross-tenant data access, compromising the privacy and operational configurations of victims' Knowledge Bases.
- Unauthorized write capability permits an attacker to alter the extraction strategies, LLM bindings, and document chunking sizes, resulting in logical compromise and context tampering across tenant boundaries.

• 来源: ⚠️ https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b
• 用户: Eric-z (UID 95890)
• 提交: 2026-04-24 13時42分 (1 月前)
• 管理: 2026-05-17 12時23分 (23 days later)
• 状态: 已接受
• VulDB条目: 364410 [Tencent WeKnora 直到 0.3.6 Config API Endpoint initialization.go getKnowledgeBaseForInitialization kbId 权限提升]
• 积分: 20