Authentication Bypass in QAnything 2.0.0

QAnything version 2.0.0 is affected by an authentication bypass vulnerability within its local document question-answering service. Specifically, the endpoints /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc lack proper authorization checks, enabling unauthenticated remote attackers to retrieve stored files. By identifying and manipulating file identifiers in requests to these endpoints, an attacker can obtain base64-encoded file contents or parsed document chunks. This flaw allows unauthorized access to cross-tenant knowledge base content, potentially leading to the leakage of intellectual property or sensitive business data uploaded to the QAnything platform. There is no evidence in the source that this is currently being exploited in the wild, but the vulnerability is high-severity due to the ease of access to stored documents.

Impact

Successful exploitation allows unauthenticated attackers to exfiltrate any document or file indexed by the QAnything 2.0.0 knowledge base, resulting in a total compromise of the confidentiality of the data stored within the platform.

Recommendation

• Patch QAnything to the latest version immediately or restrict network access to the /api/local_doc_qa/ endpoints until a vendor-supplied update is applied.
• Review web server access logs for repeated HTTP GET requests to the identified vulnerable endpoints originating from unexpected or unauthorized IP addresses.
• Deploy WAF rules to intercept and block unauthenticated traffic directed at the specific /api/local_doc_qa/ paths identified in this brief.