PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110764 iflytek CVE debrief

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants.

Vendor
iflytek
Product
astron-rpa
CVSS
MEDIUM 6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-15
Advisory published
2026-10-14
Advisory updated
2026-10-15

Who should care

Defenders responsible for AstronRPA instances, especially those using version 1.1.6 or earlier, should assess their exposure and take necessary actions to restrict access to the /file/download endpoint and monitor for suspicious activity.

Why it matters

CVE-2026-110764 is a medium-severity vulnerability in AstronRPA that allows authenticated users to download files from other tenants. Defenders should verify the vulnerability in their instances, restrict access to the /file/download endpoint, and monitor for suspicious activity.

  • Verify vulnerability in AstronRPA instances to prevent unauthorized file disclosure
  • Restrict access to the /file/download endpoint to prevent exploitation
  • Monitor for suspicious activity related to file downloads to detect potential attacks

Technical summary

The vulnerability is caused by an insecure direct object reference in the /file/download endpoint, which allows authenticated users to download files from other tenants by supplying their fileId. The FileMapper.getFile method does not perform any owner or tenant checks, making it possible for attackers to enumerate predictable time-ordered Snowflake file IDs and retrieve S3-stored files uploaded by other tenants.

Defensive priority

Defenders should prioritize verifying the vulnerability in their AstronRPA instances, especially if they are using version 1.1.6 or earlier, and restrict access to the /file/download endpoint.

Recommended defensive actions

  • Verify the vulnerability in AstronRPA instances, especially if using version 1.1.6 or earlier.
  • Restrict access to the /file/download endpoint.
  • Monitor for suspicious activity related to file downloads.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and references to technical descriptions and exploit information. The vulnerability is caused by an insecure direct object reference in the /file/download endpoint, which allows authenticated users to download files from other tenants by supplying their fileId. The FileMapper.getFile method does not perform any owner or tenant checks, making it possible for attackers to enumerate predictable time-ordered Snowflake file

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110764 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110764

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110764 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110764

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110764.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/iflytek-astron-rpa-file-download-cross-tenant-idor

    Supplemental source - technical-description, exploit

  • Source reference

    Unverified legacy reference

    URL: https://github.com/iflytek/astron-rpa/blob/b66e7c9e445906583c161bc9925432d6d39ca001/backend/resource-service/src/main/java/com/iflytek/rpa/resource/file/dao/FileMapper.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/iflytek/astron-rpa

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-cross-tenant-file-disclosure-via-file-download

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.