PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111694 qiantongtech CVE debrief

CVE-2026-111694 is a missing authentication vulnerability in qKnow through version 2.4.3 that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can exploit this vulnerability to enumerate user information and department structure. The vulnerability exists due to a lack of proper authentication mechanisms, potentially leading to unauthorized access to sensitive information. Defenders should assess exposure and verify the security of /flyflow workflow integration endpoints.

Vendor
qiantongtech
Product
qKnow
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-21
Advisory published
2026-10-16
Advisory updated
2026-10-21

Who should care

Defenders responsible for qKnow deployments should assess exposure and verify the security of /flyflow workflow integration endpoints. Security teams should review SecurityConfig to ensure proper authentication is implemented.

Why it matters

CVE-2026-111694 is a missing authentication vulnerability in qKnow through version 2.4.3 that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints, potentially leading to enumeration of user information and department structure.

  • Verify exposure of qKnow versions up to 2.4.3
  • Assess security of /flyflow workflow integration endpoints
  • Monitor for unauthorized access to user information and department structure
  • Review SecurityConfig for proper authentication implementation

Technical summary

The vulnerability exists in qKnow through version 2.4.3, allowing unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can exploit this vulnerability to enumerate user phone numbers, roles, and department structure by POSTing sequential userId values to /flyflow/userById or calling roleAll and deptListByParentDeptId. The vulnerability is caused by a missing authentication mechanism in the SecurityConfig, which allows unauthorized access to sensitive information. Defenders should prioritize verifying exposure of qKnow versions up to 2.4.3 and assessing the security of /flyflow workflow integration endpoints.

Defensive priority

Defenders should prioritize verifying exposure of qKnow versions up to 2.4.3 and assessing the security of /flyflow workflow integration endpoints.

Recommended defensive actions

  • Verify qKnow versions up to 2.4.3 are exposed and assess /flyflow workflow integration endpoint security
  • Review SecurityConfig to ensure proper authentication is implemented
  • Monitor for unauthorized access to user information and department structure
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and source item provide details on the missing authentication vulnerability in qKnow through version 2.4.3. However, the corpus does not establish versions beyond 2.4.3, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111694 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111694

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111694 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111694

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111694.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/qknow-flyflow-unauth-user-directory-disclosure

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/qiantongtech/qKnow/blob/v2.4.3/qknow-framework/qknow-security/src/main/java/tech/qiantong/qknow/security/config/SecurityConfig.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/qiantongtech/qKnow/blob/v2.4.3/qknow-module-system/qknow-module-system-biz/src/main/java/tech/qiantong/qknow/module/system/controller/admin/flyflow/FlyFlowController.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/qiantongtech/qKnow

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/qknow-through-2.4.3-missing-authentication-via-flyflow-workflow-endpoints

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.