What happened
CWE-863 authorization bypass. The AI-employee access control derives from the caller's role but accepts a caller-supplied username override, so a low-privileged user can operate privileged AI sub-agents and read their system prompts and tool config. CVSS 7.1.
Why it matters
In an AI no-code platform, 'AI employees' are agents holding their own tool permissions. Bypassing the assignment check lets a user run agents with capabilities beyond their own role and read the prompts/config that define those agents.
Attack vector
getAccessibleAIEmployee() lets an authenticated user override the role-derived filter with a supplied username, then use dispatch-sub-agent-task to run AI employees (and their tools/permissions) they were never granted, and get-ai-employee to read their prompts and tool config.
Affected systems
@nocobase/plugin-ai 2.1.0 to 2.2.41
Mitigation
Upgrade beyond plugin-ai 2.2.41 / apply the NocoBase fix (commit ae5a05954e20608de510c33847089269cb37411a, PR #11009).