Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck
CVE-2026-111694qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints
Medium 5.3
In plain English
A medium-severity missing authentication in qKnow from qiantongtech. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| qiantongtech | qKnow | 0 – through 2.4.3 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://hackmd.io/@hieuPenguinnn/qknow-flyflow-unauth-user-directory-disclosure third-party-advisory
- https://github.com/qiantongtech/qKnow/blob/v2.4.3/qknow-framework/qknow-security/src/main/java/tech/qiantong/qknow/security/config/SecurityConfig.java#L133 technical-description
- https://github.com/qiantongtech/qKnow/blob/v2.4.3/qknow-module-system/qknow-module-system-biz/src/main/java/tech/qiantong/qknow/module/system/controller/admin/flyflow/FlyFlowController.java#L77-L99 technical-description
- https://github.com/qiantongtech/qKnow product
- VulnCheck Advisory: qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints third-party-advisory