Is CVE-2026-110764 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110764?

CVE-2026-110764 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-110764

Description

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants.