{"id":"CVE-2026-119708","title":"abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name","summary":"abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request p…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"colinin","product":"abp-next-admin","affected":["abp-next-admin >= 10.4.0 <= 10.7.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:40:35.474638Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:40:56.605Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119708","references":[{"url":"https://github.com/colinin/abp-next-admin/pull/1633","label":"Pull Request #1633"},{"url":"https://github.com/colinin/abp-next-admin/commit/3ea383093d51b18984652fc9b2d3dcc779a372ee","label":"Patch Commit"},{"url":"https://github.com/colinin/abp-next-admin"},{"url":"https://github.com/colinin/abp-next-admin/issues/1628"},{"url":"https://github.com/colinin/abp-next-admin/commit/fc5e6d5a8a11a65e06fe001fe4a55e414956fc0c"},{"url":"https://github.com/colinin/abp-next-admin/blob/10.7.0/aspnet-core/modules/blob-management/LINGYUN.Abp.BlobManagement.Application/LINGYUN/Abp/BlobManagement/BlobAppService.cs#L60-L68"},{"url":"https://hackmd.io/@hieuPenguinnn/abp-next-admin-blob-download-by-name-cross-tenant-idor"},{"url":"https://www.vulncheck.com/advisories/abp-next-admin-10.4.0-through-10.7.0-cross-tenant-file-disclosure-via-blob-download-by-name","label":"VulnCheck Advisory: abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name"}],"tags":["cve.org","exploit-available"],"epss":0.00296,"epssPercentile":0.22349,"ingestedAt":"2026-11-05T16:07:30.391Z","slug":"CVE-2026-119708","body":"## Overview\n\nabp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.\n\n## Affected\n\n- `abp-next-admin >= 10.4.0 <= 10.7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":234908,"id":"CVE-2026-119708","ts":1793918475570,"field":"exploit_available","old":"false","new":"true"}]}