{"id":"CVE-2026-82475","summary":"iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check","details":"iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.","modified":"2026-09-02T08:08:03.983056Z","published":"2026-08-29T16:35:34.514Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82475.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-862"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82475.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82475"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/iflytek-astron-agent-through-1.1.1-workflow-hijacking-via-missing-ownership-check"},{"type":"REPORT","url":"https://github.com/iflytek/astron-agent/issues/1590"},{"type":"PACKAGE","url":"https://github.com/iflytek/astron-agent"},{"type":"ARTICLE","url":"https://github.com/iflytek/astron-agent/blob/v1.1.1/console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/iflytek/astron-agent","events":[{"introduced":"0"},{"fixed":"93b70e85714ab4fec974b7ed39739a743e24ce17"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.1.1"},{"fixed":"1.1.1"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v1.1.0","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v1.0.0-rc.9","v1.0.0-rc.8","v1.0.0-rc.7","v1.0.0-rc.6","v1.0.0-rc.5","v1.0.0-rc.3","v1.0.0-rc.4","v1.0.0-rc.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82475.json","vanir_signatures_modified":"2026-09-02T08:08:03Z","vanir_signatures":[{"source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/controller/knowledge/FileController.java"},"deprecated":false,"digest":{"line_hashes":["247392960429132484211915173703285925717","221360931630054993796222636365683558921","251834671157277542513678008495636488504","339965133911281365572694997927877512585","177620513487119485483345592830819943681","53881336460207055886617829939188549600","136137335724024586941515907160844572335","331940853261910131735230964373530944208","338494889552157654079738614699841572673","290244628304553161490259560033422338730","225363667720716813391079707554910781920","270983088524822029383041917975477209390","185450161610243949885322085059917247419","180874131833548401276975999583297145582"],"threshold":0.9},"id":"CVE-2026-82475-04da34ac","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-82475-1ee89267","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"function":"outputCopy","file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java"},"deprecated":false,"digest":{"function_hash":"307885328307992540039646907203273959231","length":1453}},{"digest":{"function_hash":"80533479090740677516167134824119631126","length":233},"id":"CVE-2026-82475-275e5029","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"function":"sliceFiles_EmptySeparatorList","file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/controller/knowledge/FileControllerTest.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/controller/knowledge/FileControllerTest.java"},"deprecated":false,"digest":{"line_hashes":["130490132057161150557275288396749463782","133195637246398694079542013654561341366","311558909223912008673275369358548355094","218227352195365811396785229969232888782","35601907414841874823161124389869275498","50105975583039752438790617115090641743","115557763290219804257918296206744034463","183713560525073838274007305399438175011","73219578947589698011417131077444628813","64094909768522818427114000183129352521","75502150265798912583835789888738495933","265575771124326862715351437380677839040","121662250729697475616864659468435519109","5517599600244715697726650426405141113","138501474127013153783800238938852599240","54707692257411273939328923648201709675","286777698182177635635657869815226039103","73219578947589698011417131077444628813","133887092137213427043477844879980160638","272981877196842959347846172655424578313","241539561924303502372044837340462922763","317057802987747399167225764975404490547","227833476000251790318448734901789860383","307098767990671990853693718766612952633","253764894494723881851607547235597892200","336779767788061414273174571515044574147","158899073924417316319689909731067077855"],"threshold":0.9},"id":"CVE-2026-82475-2946a73f"},{"deprecated":false,"digest":{"function_hash":"169760939566953399166267402650416537241","length":1588},"id":"CVE-2026-82475-2a2f474d","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/service/knowledge/FileInfoV2ServiceTest.java","function":"testSliceFiles_Success_SingleFile"}},{"source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/repo/FileInfoV2Service.java","function":"validateSliceRangeForAiui"},"deprecated":false,"digest":{"function_hash":"23106146813880730569637580358548130772","length":367},"id":"CVE-2026-82475-2a44fad9","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["109261521310813038746840094379230281840","110451596685752138908592071593084796854","5626058736590720474912342868023702157","115449359959014488462163752081895395852","223443399139332057581329022212011125508","179025655020380604840600764204637047093","244511994022273295563253604397554758549","62199197475466534544444700014613517666","23775263939377261538843828543812258597","11488701161849026146760982722061465406","50009347067310816157383604036202619880","326056052942939198392917806327816958689","323168529106480634095297377063687136011","252371415082515850035839579532410961150","146043284349234672954379653951435933552","62199197475466534544444700014613517666","74726091507278552335031641997915299733","309260132952416009849076875551726698031","186923475576918327522738915626561423449","111892471997309927573911730507418799854","79287324256154529507034783171005704880","32629330395749445317411673104694931274","288433922683893643423207667450739628048","319791762064838026728887948200141505054","276062893175936501790414190932316719930","315396910879995504888505832638862665916","226550384098790373271798423140306487485"]},"id":"CVE-2026-82475-2cfb5716","signature_type":"Line","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/service/knowledge/FileInfoV2ServiceTest.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["18374627690875759825658030435982966840","89620269000740663195576177056028415580","302014605186273262876063617059906255352","336513453482451978467563025852748002201","71623152622803793541710734840904903576","88286510984560456804819338051810642119","268366434679016976385374934745426202101","160477780259531256247531566723244281656","240601491473576694705956012419401540659","153215880148822633451099239848790434562","247331731370923973840882133567714333833","153556053696316770923685450960564700257","55860661952023906935836369778026921689","93578001752167125340568754486919729187","40442799386503914696043009872441108500","6020653435430365239245153673582972690","331917542029478421666717391725691808828","201476348892479362390072870821853297925","66423581874604197952754763489584743154","38469105579127460219097475767087518179","331644298250539135700461178562593956891","260603054312616841102090457449456717603","86181659343112193881552392276983586100","196821427961443464341644035930007554277","299935344017200283563437001840881214533","156974292503482121892207194410052083253","321007152007402207707055890994784058029","147730917493214467023291110909170972480","46708902919449966368889969060700149454","336569181772718972327786972879152032537"],"threshold":0.9},"id":"CVE-2026-82475-3331a8ad","signature_type":"Line","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/repo/KnowledgeService.java"}},{"source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"function":"sliceFiles_Success_EmptySeparatorDefaultsToNewline","file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/controller/knowledge/FileControllerTest.java"},"deprecated":false,"digest":{"function_hash":"230108417113878195088493553348025459603","length":747},"id":"CVE-2026-82475-37632441","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"function":"ensureSeparatorDefault","file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/repo/FileInfoV2Service.java"},"deprecated":false,"digest":{"function_hash":"69106676286786072200880213570108921200","length":250},"id":"CVE-2026-82475-413ee4b0","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["238931823678633110748226008305758412620","218172056207923174257348252103948893557","125116126459214912501055733965483249180","315384635584205269693081033487353676459","144532336204710440136452106842390088588","336131566196518522058255887501944800397","139916825915692216395419367362565125654","311668306281568040534159815963948304782","47964777319894798297873009567439941642","8151532080824942476819512209224211166","299088498739818761023807646628486885158"],"threshold":0.9},"id":"CVE-2026-82475-5c9c1496","signature_type":"Line","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java"}},{"id":"CVE-2026-82475-6c4933fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/repo/KnowledgeService.java","function":"knowledgeEmbeddingExtractAsync"},"deprecated":false,"digest":{"function_hash":"195257481241258543689202934678654396974","length":1261}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/service/knowledge/KnowledgeServiceTest.java"},"deprecated":false,"digest":{"line_hashes":["134505725812140744222432859196926544854","212326375525846881694059375642031111490","328104497072765422678268395627899463401","337918676121378869125626804474094358371","139935689026180515892120987288474235265","257160828204021375916835946550039331134"],"threshold":0.9},"id":"CVE-2026-82475-6deb1d10"},{"target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/repo/FileInfoV2Service.java"},"deprecated":false,"digest":{"line_hashes":["186620098846076584233613662154468527283","319060211027403165506971281249063023724","277531783036778695766059997660952845146","130238782739536311546420638202465459169","17682257623206975886465783373983927699","250517975521856618388993256269302544574","283653677563802441049568099367631805356","20583573984504914397280633851151006016","24537854804180668540406033414813456491","210735697136247450576628402390023785767","74809068334121762071370116660367692607","259160926310544489570566582140438300143","315824481461607706198442773158118954575","43873527906666762718101232158324225568","172902337279465960370552234547877459314","24131747692818295594550448304670105866","329941954327061492141378416270635550195","145715763088225783212091583169353880922","2441303744327928138201725539478487431","164361060301714988151367555691373694228","126519321619800713698676145449279348530","206956291482885527520914229104999825753","65103098417795881641046267851725941994","242335170180094480803063374822266403819","247467072384593346779635263743102919212","303624029377484011055583198966602252984","2145850582108765714602188730389157325","337333749914899743152113866076266572670","153844525864915583897682798386332281244","201876419340306534848846705575442553276","110544994951754140733026531421763779950","21989198319479591477054954284194930853","267259450080582379125145713737925817248","84670405959473358061033470700121381000","205575968660860986950850740781530610878","230085743906574206900315277437834911176","158938163664722923877992907611632826063","210162204446582528181715457200019154516","284631054927676002495951316444959927403","260645198334629855908803062286795710140","295251434404839925942628118555806831173","56994990185475702174935464377831733363","169687737898544971580326858238459435884","83918365553965581971104773621348480912","131957722202332247747283286714266412642","237935793994051198200247233481215673561","265340207537631255849030390854002093364","268838610924802873602379618380082631268","54903999508475475437315642195073254441","53279429877542730699309067065356629035","264403927048073909070227352832106775030","151286564507553723836560265480282620044","168027456574477996083740401907969480572","311211869594816746978194688435051131028","312151392360203495100847708019934399494","29119277448400477869211856619323706156","199643626850402285028999967650939659258","149609161047414043864410452048777541544","321922925434074919130029887999960321709","236655579685438725640473510556335037981","256489499234493372087468237602365442208","126598551125412955276649696630022581538","67211465329154829983412016130640131935","325936496595708204323476389010810776655","211829665067581465034031138565908377701","45120714061504412073955869140668226558","270752193876081166819450623031715728824","21385862108382505592773765943334881666","144135696225736035634750934816651979163","257077891847596344963962307344038705761","313912758061948673854730543002568150167","328739341329054986255114472082139013050","94046561540923603322037951390029651023","18490934721510725981333756685598299533","332387484698609104093333201370800499373","187936865630095398269298196100816013152","259036034263527838150974215097708517377","46047276998337562918255247763243605875","313918263847981278560965609772251422868","297716428960824838405757990029183886569","319561232840272556610363299501507422684","38688708752444591105387094928051671056","83220195131712697185384297850474556620","253730874238892632039574008595357876277","137528958891102545453116852194310666951","250720914806894813920188862983853220620","170099897449672721022389030821616910908","269331112386762286318819030736681623738","265596525813296890988704066964260932838","307325435085572867320673247672018203135","5978660299313030616852328028559531389","291653505548419472307010013633749158817","324575686935994818984038774586298731855","235551292962827326291090804126057229329","319925830197926069398696154020589244372","87860416103269516438779239478093092396","65103098417795881641046267851725941994","12125558315547171981524485945168491114"],"threshold":0.9},"id":"CVE-2026-82475-8e9abf6b","signature_type":"Line","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17"},{"source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"function":"saveRemote","file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/workflow/WorkflowService.java"},"deprecated":false,"digest":{"function_hash":"241063270393038365702881675386024427639","length":1183},"id":"CVE-2026-82475-a4a1b499","signature_type":"Function","signature_version":"v1"},{"digest":{"length":1506,"function_hash":"141003275781328065291306772912479830297"},"id":"CVE-2026-82475-a5bb4d1f","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/service/knowledge/FileInfoV2ServiceTest.java","function":"testSliceFile_Success"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"307861983267463924941547640657970165426","length":477},"id":"CVE-2026-82475-bdd55973","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/controller/knowledge/FileController.java","function":"sliceFiles"}},{"signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/controller/knowledge/FileControllerTest.java","function":"sliceFiles_Success_NullSeparatorDefaultsToNewline"},"deprecated":false,"digest":{"function_hash":"136991066305680643418627023370101403571","length":700},"id":"CVE-2026-82475-c7083485","signature_type":"Function"},{"target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/repo/FileInfoV2Service.java","function":"sliceFiles"},"deprecated":false,"digest":{"function_hash":"131739435909045129384913350440172256165","length":3523},"id":"CVE-2026-82475-c74062e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17"},{"signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/repo/FileInfoV2Service.java","function":"handleParseFailedRetry"},"deprecated":false,"digest":{"function_hash":"217283935202090567913210020093038229376","length":742},"id":"CVE-2026-82475-d1dd5cab","signature_type":"Function"},{"id":"CVE-2026-82475-dbad6ba4","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/repo/FileInfoV2Service.java","function":"sliceFile"},"deprecated":false,"digest":{"function_hash":"57226071737975945395298448642098110994","length":1958}},{"target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/repo/FileInfoV2Service.java","function":"retry"},"deprecated":false,"digest":{"function_hash":"166627063483600242696325993695775084492","length":820},"id":"CVE-2026-82475-e186571d","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17"},{"id":"CVE-2026-82475-eddb2be3","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/93b70e85714ab4fec974b7ed39739a743e24ce17","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/service/knowledge/FileInfoV2ServiceTest.java","function":"testSliceFile_CbgUnsupportedType"},"deprecated":false,"digest":{"function_hash":"242878211754252808373863385255794499587","length":576}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}