CVE-2026-108547: Authorization Bypass Through User-Controlled Key in iflytek astron-rpa

AstronRPA versions up to and including 1.1.6 contain a missing tenant authorization check in the robot-service's get-batch-shared-var endpoint. This flaw permits authenticated users to read shared variables of other tenants by enumerating sequential shared variable IDs. Because variables are re-encrypted with the attacker's tenant key, attackers can decrypt and recover credentials of other tenants in plaintext, resulting in an authorization bypass through a user-controlled key.

The vulnerability allows authenticated users to bypass tenant isolation controls and access sensitive shared variables belonging to other tenants. This leads to exposure of plaintext credentials across tenants, potentially compromising multiple accounts and systems relying on these credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to trusted parties only and monitor for suspicious access patterns to the get-batch-shared-var endpoint.