CVE-2026-111694
Received Received - Intake

Unauthenticated Access to qKnow Workflow Integration Endpoints

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111694
EUVD
EUVD-2026-102985

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qiantongtech qKnow 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

qKnow through version 2.4.3 has a missing authentication vulnerability. This allows unauthenticated remote attackers to access specific workflow integration endpoints that should be restricted. Attackers can send POST requests to endpoints like /flyflow/userById or call roleAll and deptListByParentDeptId to gather sensitive information such as user phone numbers, roles, and department structures.

Detection Guidance

Check for unauthorized access to /flyflow/userById or /flyflow/roleAll endpoints. Monitor POST requests with sequential userId values or calls to roleAll and deptListByParentDeptId. Inspect logs for unusual enumeration attempts targeting user phone numbers, roles, or department structures.

Impact Analysis

This vulnerability allows attackers to enumerate sensitive user data without authentication. They can collect phone numbers, roles, and department structures, which could lead to further attacks like phishing, social engineering, or unauthorized access to systems. The impact includes privacy breaches and potential compromise of organizational data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage for organizations.

Mitigation Strategies

Implement authentication for /flyflow endpoints. Restrict access to these paths via firewall rules or network segmentation. Update qKnow to the latest version if a patch is available. Monitor for suspicious activity related to these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111694. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart