---
id: CVE-2026-111694
title: qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints
summary: >-
  qKnow through 2.4.3 contains a missing authentication vulnerability that
  allows unauthenticated remote attackers to access /flyflow workflow
  integration endpoints permitted in SecurityConfig. Attackers can POST
  sequential userId values t…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: qiantongtech
product: qKnow
affected:
  - qKnow <= 2.4.3
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:39:49.601Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111694'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/qknow-flyflow-unauth-user-directory-disclosure
  - url: >-
      https://github.com/qiantongtech/qKnow/blob/v2.4.3/qknow-framework/qknow-security/src/main/java/tech/qiantong/qknow/security/config/SecurityConfig.java#L133
  - url: >-
      https://github.com/qiantongtech/qKnow/blob/v2.4.3/qknow-module-system/qknow-module-system-biz/src/main/java/tech/qiantong/qknow/module/system/controller/admin/flyflow/FlyFlowController.java#L77-L99
  - url: 'https://github.com/qiantongtech/qKnow'
  - url: >-
      https://www.vulncheck.com/advisories/qknow-through-2.4.3-missing-authentication-via-flyflow-workflow-endpoints
    label: >-
      VulnCheck Advisory: qKnow through 2.4.3 Missing Authentication via
      /flyflow Workflow Endpoints
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.656Z'
---

## Overview

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.

## Affected

- `qKnow <= 2.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.