CVE-2026-111363

Deferred Deferred - Pending Action

Insecure Direct Object Reference in BISHENG 3.0.0-beta4

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111363

Affected Vendors & Products

Vendor	Product	Version / Range
dataelement	bisheng	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

BISHENG through 3.0.0-beta4 has an insecure direct object reference vulnerability. Authenticated low-privileged users can read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file IDs against the GET /api/v1/knowledge/file_bbox endpoint to retrieve extracted page text from other users' and tenants' knowledge bases.

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to GET /api/v1/knowledge/file_bbox with sequential or arbitrary file_id values. Check application logs for unauthorized access attempts to other users' documents.

Impact Analysis

This vulnerability allows unauthorized access to sensitive documents. Attackers with low privileges can read confidential or proprietary information from other users or tenants, potentially leading to data breaches, intellectual property theft, or privacy violations.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR, HIPAA, and other privacy regulations. Unauthorized access to personal or sensitive data may result in legal penalties, fines, or reputational damage due to violations of data protection requirements.

Mitigation Strategies

Immediately update BISHENG to a patched version beyond 3.0.0-beta4. Implement access controls to restrict file_id enumeration and enforce strict authentication checks for document access.

Hi! I’m here to help you understand CVE-2026-111363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70