CVE-2026-110764

Deferred Deferred - Pending Action

Insecure Direct Object Reference in AstronRPA Resource Service

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110764

EUVD

EUVD-2026-101564

Affected Vendors & Products

Vendor	Product	Version / Range
iflytek	astron-rpa	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-110764 is an insecure direct object reference (IDOR) vulnerability in AstronRPA through version 1.1.6. The flaw exists in the /file/download endpoint of the resource-service. Authenticated users can exploit this to download files belonging to other tenants by supplying a valid fileId. The vulnerability occurs because FileMapper.getFile performs no ownership or tenant validation, only checking if the file exists and is not deleted. File IDs are generated using a predictable, time-ordered Snowflake-style format, making them easy to enumerate.

Detection Guidance

To detect this vulnerability, monitor access logs for the /file/download endpoint in AstronRPA's resource-service. Look for requests with varying fileId parameters from the same authenticated user. Check if responses include files not uploaded by the requesting tenant. Use network traffic analysis tools to inspect HTTP GET requests to this endpoint for suspicious fileId patterns.

Impact Analysis

This vulnerability allows attackers to access sensitive files uploaded by other tenants. If you use AstronRPA, an attacker could download your confidential documents, business data, or other files stored in S3 by guessing nearby file IDs. The impact includes data breaches, loss of intellectual property, and potential compliance violations. Attackers only need to be authenticated users, making exploitation feasible for insiders or compromised accounts.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguards for protected health information. The cross-tenant file disclosure could lead to data exposure, resulting in regulatory fines, legal liabilities, and reputational damage. Organizations using AstronRPA must address this flaw to maintain compliance.

Mitigation Strategies

Immediately update AstronRPA to a patched version beyond 1.1.6. As a temporary fix, restrict access to the /file/download endpoint to authorized users only. Add tenant ownership validation in FileMapper.getFile by including tenant ID checks in the SQL query. Disable file ID enumeration by randomizing file IDs instead of using time-ordered Snowflake IDs.

Hi! I’m here to help you understand CVE-2026-110764. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70