Skip to content
OpenAdvisories

Product · iflytek

astron-rpa

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-110764

    AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download

    AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable …

    iflytek astron-rpa
  • Medium 6.5
    CVE-2026-108547

    AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

    AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and de…

    iflytek astron-rpa