CVE-2026-108547 — AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-…
Published: 2026-10-10 · CVSS: 7.1 · CVSS 4.0
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7