Threats tagged 'ghsa-whrv-p3hh-8mvr'

CVE-2026-108864 is an authorization bypass vulnerability in iFlytek Astron Agent versions up to 1.1.2. It allows authenticated applications to resume other applications' paused workflows by supplying their event_id to the POST /workflow/v1/resume endpoint. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation. The vulnerability has a low severity score and affects cloud-hosted services.