---
id: CVE-2026-119648
title: >-
  BlueKing CMDB through 3.14.6 Missing Authorization via
  /api/v3/hosts/search/asstdetail
summary: >-
  Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing
  authorization vulnerability that allows authenticated users to view hosts of
  other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can
  submit host search co…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: TencentBlueKing
product: bk-cmdb
affected:
  - bk-cmdb <= 3.14.6
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:30:47.743805Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:31:11.514Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119648'
references:
  - url: 'https://github.com/TencentBlueKing/bk-cmdb/issues/8709'
  - url: >-
      https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/service/host.go#L605-L620
  - url: >-
      https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/ac/parser/host.go#L797-L819
  - url: >-
      https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/logics/hostsearch.go#L36-L72
  - url: >-
      https://hackmd.io/@hieuPenguinnn/bk-cmdb-host-search-asstdetail-cross-business-missing-authz
  - url: 'https://github.com/TencentBlueKing/bk-cmdb'
  - url: >-
      https://www.vulncheck.com/advisories/blueking-cmdb-through-3.14.6-missing-authorization-via-api-v3-hosts-search-asstdetail
    label: >-
      VulnCheck Advisory: BlueKing CMDB through 3.14.6 Missing Authorization via
      /api/v3/hosts/search/asstdetail
tags:
  - cve.org
  - exploit-available
epss: 0.0029
epssPercentile: 0.21643
ingestedAt: '2026-11-05T16:07:30.290Z'
---

## Overview

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.

## Affected

- `bk-cmdb <= 3.14.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.