GitHub Security Advisory: GHSA-2f4c-vrjq-rcgv
Package: github.com/Tencent/WeKnora (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 0.2.11
Patched in: 0.2.12

Summary: WeKnora has Broken Access Control - Cross-Tenant Data Exposure

Details:
## Summary
A broken access control vulnerability in the database query tool allows any authenticated tenant to read sensitive data belonging to other tenants, including API keys, model configurations, and private messages. The application fails to enforce tenant isolation on critical tables (`models`, `messages`, `embeddings`), enabling unauthorized cross-tenant data access with user-level authentication privileges.

---

## Details

### Root Cause
The vulnerability exists due to a mismatch between the queryable tables and the tables protected by tenant isolation in `internal/utils/inject.go`.

**Tenant-isolated tables** (protected by automatic `WHERE tenant_id = X` clause):
```
tenants, knowledge_bases, knowledges, sessions, chunks
```

**Queryable tables** (allowed by `WithAllowedTables()` in `WithSecurityDefaults()`):
```
tenants, knowledge_bases, knowledges, sessions, messages, chunks, embeddings, models
```

**Gap**: The tables `messages`, `embeddings`, and `models` are queryable but NOT in the tenant isolation list. This means queries against these tables do NOT receive the automatic `WHERE tenant_id = X` filtering.

### Vulnerable Code

**File: `internal/utils/inject.go`**

```go
func WithTenantIsolation(tenantID uint64, tables ...string) SQLValidationOption {
	return func(v *sqlValidator) {
		v.enableTenantInjection = true
		v.tenantID = tenantID
		v.tablesWithTenantID = make(map[string]bool)
		if len(tables) == 0 {
			// Default tables with tenant_id - MISSING: messages, embeddings, models
			v.tablesWithTenantID = map[string]bool{
				"tenants":         true,
				"knowledge_bases": true,
				"knowledges":      true,
				"sessions":        true,
				"chunks":          true,
			}
		} else {
			for _, table := range tables {
				v.tablesWithTenantID[strings.ToLower(table)] = true
			}
		}
	}
}

func WithSecurityDefaults(tenantID uint64) SQLValidationOption {
	return func(v *sqlValidator) {
		// ... other validations ...
		WithTenantIsolation(tenantID)(v)

		// Default allowed tables - INCLUDES unprotected tables
		WithAllowedTables(
			"tenants",
			"knowledge_bases",
			"knowledges",
			"sessions",
			"messages",           // ← No tenant isolation
			"chunks",
			"embeddings",         // ← No tenant isolation
			"models",             // ← No tenant isolation
		)(v)
	}
}
```

**File: `database_query.go`**

```go
func (t *DatabaseQueryTool) validateAndSecureSQL(sqlQuery string, tenantID uint64) (string, error) {
	securedSQL, validationResult, err := utils.ValidateAndSecureSQL(
		sqlQuery,
		utils.WithSecurityDefaults(tenantID),
		utils.WithInjectionRiskCheck(),
	)
	// ... validation logic ...
	return securedSQL, nil
}
```

When tenant 1 queries `SELECT * FROM models`, the validation passes and **no** `WHERE tenant_id = 1` clause is appended because `models` is not in the `tablesWithTenantID` map. The unfiltered result exposes all model records across all tenants.

---

## PoC

### Prerequisites
- Access to the AI application as an authentic