Is CVE-2026-85671 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85671 being exploited in the wild.

How severe is CVE-2026-85671?

High severity, with a CVSS score of 7.5, published 4 September 2026.

Is there a fix for CVE-2026-85671?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85671 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85671?

Check whether you run Netease QAnything at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85671: Netease QAnything authentication bypass in file retrieval endpoints

CVE-2026-85671 · Severity: high · CVSS 7.5 · Published 2026-09-04

QAnything is a document question-answering application that allows organizations to upload and query knowledge bases. Version 2.0.0 contains a flaw in two API endpoints (/api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc) that fails to verify user authentication and document ownership, allowing anyone with network access to retrieve and read any uploaded file or document without logging in. An attacker can extract sensitive business documents, customer data, and proprietary information from any knowledge base in the system.

Vendors: Netease.

Quick answers

Is CVE-2026-85671 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85671 being exploited in the wild.
How severe is CVE-2026-85671?: High severity, with a CVSS score of 7.5, published 4 September 2026.
Which products and versions are affected?: Netease QAnything 2.0.0.
Is there a fix for CVE-2026-85671?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85671 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85671?: Check whether you run Netease QAnything at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc API endpoints. The vulnerable endpoints fail to enforce authentication checks and document ownership validation, allowing unauthenticated network attackers to enumerate file and document identifiers through other unauthenticated endpoints and retrieve the base64-encoded file contents or parsed document chunks without any authorization. An attacker can systematically access cross-tenant knowledge base content by iterating through identifiers, resulting in confidentiality breach affecting all stored documents. The vulnerability is present in the sanic_api.py and handler.py request handling code in version 2.0.0 and requires no user interaction or authentication.

Affected products

Netease QAnything 2.0.0

Timeline

2026-09-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.