CVE-2026-108864 — iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflo…
Published: 2026-10-11 · CVSS: 2.3 · CVSS 4.0
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7