CVE-2026-108547: Iflytek Astron-Rpa

Medium severity, CVSS 6.5.

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.

Affected products

• Iflytek Astron-Rpa: up to and including 1.1.6

Published 2026-10-10. Last modified 2026-10-10.