CyberRota Analysis
AI-GeneratedThe vulnerability in iFlytek astron-agent allows authenticated attackers to bypass authorization controls in the copyFlow endpoint, enabling them to enumerate workflow identifiers and potentially overwrite or access private workflows belonging to other tenants. This could lead to unauthorized exposure of sensitive workflow definitions and manipulation of workflows. Organizations utilizing this software should prioritize remediation efforts to mitigate the risk of data leakage and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.