Vulnerability · Published Oct 10, 2026 · Assigned by VulnCheck

CVE-2026-108547AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in astron-rpa from iflytek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.

Affected products (as reported)

Vendor	Product	Versions
iflytek	astron-rpa	0 – through 1.1.6

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #884 issue-tracking
https://github.com/iflytek/astron-rpa product
https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/robot-service/src/main/java/com/iflytek/rpa/robot/dao/SharedVarDao.xml#L52-L63 technical-description
https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/robot-service/src/main/java/com/iflytek/rpa/robot/service/impl/SharedVarServiceImpl.java#L197-L255 technical-description
VulnCheck Advisory: AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var third-party-advisory