CVE-2026-111363: Authorization Bypass Through User-Controlled Key in dataelement bisheng

CVE-2026-111363 describes an authorization bypass vulnerability in the dataelement bisheng product up to version 3.0.0-beta4. The flaw is an insecure direct object reference (IDOR) that permits authenticated users with low privileges to supply arbitrary file_id values to the GET /api/v1/knowledge/file_bbox API endpoint. This allows them to enumerate file IDs sequentially and access parsed document data from other users and tenants, violating access controls.

The vulnerability allows unauthorized disclosure of sensitive parsed document contents from other users and tenants within the knowledge base system. This could lead to information leakage and compromise of confidentiality for affected users. There is no indication of privilege escalation or remote code execution. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious enumeration activity. Implement additional access control checks on file_id parameters to enforce user and tenant boundaries.