CVE-2026-108864 [MEDIUM] – iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerabil

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications’ paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation.