What is CVE-2026-82475?

CVE-2026-82475 is a high-severity vulnerability in Iflytek Astron-Agent, classified under Missing Authorization. CVSS score: 8.1/10. Published 2026-08-29.

How severe is CVE-2026-82475?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in Iflytek Astron-Agent

CVE-2026-82475

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Iflytek Astron-agent

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-82475?: CVE-2026-82475 is a high-severity vulnerability in Iflytek Astron-Agent, classified under Missing Authorization. CVSS score: 8.1/10. Published 2026-08-29.
How severe is CVE-2026-82475?: High severity. CVSS v3 base score is 8.1 out of 10.