CyberRota Analysis
AI-GeneratedQAnything 2.0.0 is vulnerable to an authentication bypass in its API endpoints, allowing unauthenticated attackers to access and enumerate uploaded files and documents. This flaw enables the unauthorized disclosure of sensitive cross-tenant knowledge base content, posing a significant risk to data confidentiality. Organizations using this version of QAnything should prioritize patching to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and retrieve base64-encoded files or parsed document chunks without ownership verification to disclose cross-tenant knowledge base content.