Is CVE-2026-111363 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111363 being exploited in the wild.

How severe is CVE-2026-111363?

Medium severity, with a CVSS score of 6.5, published 15 October 2026.

Which products and versions are affected?

Dataelement BISHENG through 3.0.0-beta4.

Is there a fix for CVE-2026-111363?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111363 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111363?

Check whether you run Dataelement BISHENG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111363: BISHENG insecure direct object reference in knowledge file API

CVE-2026-111363 · Severity: medium · CVSS 6.5 · Published 2026-10-15

BISHENG is an open-source LLM operations platform that manages AI workflows and knowledge bases for enterprises. An authentication bypass flaw allows authenticated users with limited privileges to view other users' and organizations' confidential documents by manipulating file identifiers in API requests. An attacker could retrieve sensitive extracted text and data from knowledge bases belonging to other tenants without authorization.

Technologies: Dataelement BISHENG. Vendors: Dataelement.

Quick answers

Is CVE-2026-111363 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111363 being exploited in the wild.
How severe is CVE-2026-111363?: Medium severity, with a CVSS score of 6.5, published 15 October 2026.
Which products and versions are affected?: Dataelement BISHENG through 3.0.0-beta4.
Is there a fix for CVE-2026-111363?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111363 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111363?: Check whether you run Dataelement BISHENG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insecure direct object reference (IDOR) in the GET /api/v1/knowledge/file_bbox endpoint. Authenticated low-privileged users can enumerate sequential file_id values to access parsed documents and extracted page text from other users' and tenants' knowledge bases without proper authorization checks. The flaw requires valid authentication but no elevation of privilege.

Affected products

dataelement BISHENG through 3.0.0-beta4

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.