CVE-2026-111694 — qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints
qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in S…
Published: 2026-10-16 · CVSS: 6.9 · CVSS 4.0
qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7