CVE-2026-82475

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82475
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82475.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82475
Published
2026-08-29T16:35:34Z
Modified
2026-10-21T03:00:26Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check
Details

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82475.json"
}
References

Affected packages

Git / github.com/iflytek/astron-agent

Affected ranges

Type
GIT
Repo
https://github.com/iflytek/astron-agent
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
93b70e85714ab4fec974b7ed39739a743e24ce17
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.1.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.1.1"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.0-rc.2
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.0-rc.5
v1.0.0-rc.6
v1.0.0-rc.7
v1.0.0-rc.8
v1.0.0-rc.9
v1.0.1
v1.0.2
v1.0.3
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82475.json"