Authentication Bypass in AstronRPA via Shared Variables

Executive Summary

CVE-2026-108547 is a cross-tenant shared variable disclosure vulnerability in AstronRPA through version 1.1.6. It allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint due to a missing tenant authorization check. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for unauthorized access to the /robot-shared-var/get-batch-shared-var endpoint. Check logs for repeated requests with sequential shared variable IDs. Verify if tenant isolation is enforced in database queries like getAvailableByIds.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access sensitive data like credentials or configuration values belonging to other tenants. If exploited, it could lead to unauthorized data exposure, credential theft, or potential lateral movement within the system. The impact is significant as it bypasses tenant isolation, compromising data confidentiality across the platform.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA, which mandate strict tenant data isolation and encryption. Unauthorized cross-tenant data access could result in regulatory penalties, loss of trust, and legal consequences due to compromised data confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AstronRPA to a patched version. Add tenant filters to the getAvailableByIds query to enforce tenant isolation. Validate and sanitize input data in the packageEncryptValue method to prevent injection attacks.

Useful 0 Not Useful 0