{"id":"CVE-2026-119648","title":"BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail","summary":"Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search co…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"TencentBlueKing","product":"bk-cmdb","affected":["bk-cmdb <= 3.14.6"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:30:47.743805Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:31:11.514Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119648","references":[{"url":"https://github.com/TencentBlueKing/bk-cmdb/issues/8709"},{"url":"https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/service/host.go#L605-L620"},{"url":"https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/ac/parser/host.go#L797-L819"},{"url":"https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/logics/hostsearch.go#L36-L72"},{"url":"https://hackmd.io/@hieuPenguinnn/bk-cmdb-host-search-asstdetail-cross-business-missing-authz"},{"url":"https://github.com/TencentBlueKing/bk-cmdb"},{"url":"https://www.vulncheck.com/advisories/blueking-cmdb-through-3.14.6-missing-authorization-via-api-v3-hosts-search-asstdetail","label":"VulnCheck Advisory: BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail"}],"tags":["cve.org","exploit-available"],"epss":0.0029,"epssPercentile":0.21643,"ingestedAt":"2026-11-05T16:07:30.290Z","slug":"CVE-2026-119648","body":"## Overview\n\nTencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.\n\n## Affected\n\n- `bk-cmdb <= 3.14.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":234880,"id":"CVE-2026-119648","ts":1793918465943,"field":"exploit_available","old":"false","new":"true"}]}