CVE-2026-111694: Missing Authentication for Critical Function in qiantongtech qKnow

CVE-2026-111694 describes a missing authentication vulnerability in qiantongtech's qKnow product through version 2.4.3. This flaw permits unauthenticated remote attackers to access /flyflow workflow integration endpoints that should be protected by SecurityConfig. Exploitation involves POSTing sequential userId values to the /flyflow/userById endpoint or invoking roleAll and deptListByParentDeptId endpoints to enumerate sensitive user information such as phone numbers, roles, and department hierarchy. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level with network attack vector, low complexity, and no privileges or user interaction required.

The vulnerability allows unauthenticated attackers to access sensitive user information including phone numbers, roles, and organizational structure by abusing unprotected API endpoints. This exposure can lead to privacy violations and potentially facilitate further targeted attacks or social engineering based on the enumerated data. However, there is no indication of direct system compromise or code execution from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected /flyflow endpoints through network controls or authentication enforcement to prevent unauthorized access.