---
id: CVE-2026-119659
title: Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
summary: >-
  Blossom through 1.17.1 contains an authorization bypass vulnerability that
  allows authenticated users to access other users' folders because
  FolderService queries filter only on folder id. Attackers can supply another
  user's folder id to…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: blossom-editor
product: Blossom
affected:
  - Blossom <= 1.17.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T22:34:45.454666Z'
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:34:56.679Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119659'
references:
  - url: 'https://github.com/blossom-editor/blossom/issues/213'
  - url: >-
      https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/folder/FolderService.java#L123-L202
  - url: >-
      https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/resources/mapper/FolderMapper.xml#L64-L92
  - url: >-
      https://hackmd.io/@hieuPenguinnn/blossom-folder-idor-cross-user-modify-delete
  - url: 'https://github.com/blossom-editor/blossom'
  - url: >-
      https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-folder-endpoints
    label: >-
      VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Folder
      Endpoints
tags:
  - cve.org
epss: 0.00263
epssPercentile: 0.18249
ingestedAt: '2026-11-05T21:36:00.651Z'
---

## Overview

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.

## Affected

- `Blossom <= 1.17.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.