Tencent WeKnora up to version 0.3.6 contains an authorization bypass vulnerability in the getKnowledgeBaseForInitialization function of the Config API Endpoint. By manipulating the kbId argument, an attacker can bypass authorization checks remotely. The vulnerability has been publicly disclosed, and the vendor has not issued a response or patch. The CVSS 4.0 score is 5.3 (medium severity), indicating a network attack vector with low complexity and no privileges required, but limited impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to bypass authorization controls in Tencent WeKnora, potentially granting unauthorized access to knowledge base initialization data or functionality. The impact is rated medium severity, reflecting limited but non-negligible risk. There is no evidence of active exploitation in the wild.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or provided a fix, users should consider implementing additional access controls or network-level restrictions to limit exposure to the vulnerable API endpoint. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.