Threats tagged 'ghsa-mcqv-c7v8-6mw4'

CVE-2026-108547 is a high-severity vulnerability in iflytek AstronRPA versions up to 1.1.6. It involves a missing tenant authorization check in the robot-service component, allowing authenticated users to access shared variables belonging to other tenants via the get-batch-shared-var endpoint. Attackers can enumerate shared variable IDs and decrypt variables re-encrypted with their own tenant key, exposing other tenants' credentials in plaintext.