CVE-2026-111363 dataelement CVE debrief

Who should care

Defenders responsible for securing BISHENG deployments should assess exposure and prioritize remediation to prevent unauthorized access to sensitive information. This includes reviewing and updating access controls, implementing proper input validation and sanitization, and monitoring and auditing access to the affected endpoint. Security teams and vulnerability management teams should also be aware of the potential impact and take necessary steps to rem

Why it matters

CVE-2026-111363 is a high-severity vulnerability in BISHENG through 3.0.0-beta4 that allows authenticated low-privileged users to read other users' parsed documents. Defenders responsible for securing BISHENG deployments should assess exposure and prioritize remediation to prevent unauthorized access to sensitive information.

• Authenticated low-privileged users can access sensitive documents without proper authorization.
• The vulnerability can be exploited by enumerating sequential file ids against GET /api/v1/knowledge/file_bbox.
• The impact is limited to reading parsed documents, but not modifying or deleting them.
• Remediation priority is high due to the potential for unauthorized access to sensitive information.

Technical summary

The BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. This vulnerability can be exploited by enumerating sequential file IDs against the GET /api/v1/knowledge/file_bbox endpoint, allowing unauthorized access to sensitive information. The impact is limited to reading parsed documents without modification or deletion. Defenders should assess exposure and prioritize remediation to prevent unauthorized access.

Defensive priority

High

Recommended defensive actions

• Review and update access controls for the /api/v1/knowledge/file_bbox endpoint to prevent unauthorized access to sensitive documents.
• Implement proper input validation and sanitization for file_id values to prevent IDOR attacks.
• Monitor and audit access to the affected endpoint to detect potential exploitation attempts.
• Consider upgrading to a version of BISHENG that is not vulnerable to this issue.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the insecure direct object reference vulnerability in BISHENG through 3.0.0-beta4. The vulnerability allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.