Vulnerability · Published Aug 29, 2026 · Assigned by VulnCheck
CVE-2026-82475iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check
High 8.1
In plain English
A high-severity missing authorization in astron-agent from iflytek. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 60.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| iflytek | astron-agent | 0 – through 1.1.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- GitHub Issue #1590 issue-tracking
- https://github.com/iflytek/astron-agent/blob/v1.1.1/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java technical-description
- https://github.com/iflytek/astron-agent product
- VulnCheck Advisory: iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check third-party-advisory