---
id: CVE-2026-119708
title: >-
  abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob
  Download-By-Name
summary: >-
  abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization
  bypass in the BlobManagement download-by-name endpoint, letting authenticated
  users read other tenants' files. Attackers supply a victim tenantId in the
  request p…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: colinin
product: abp-next-admin
affected:
  - abp-next-admin >= 10.4.0 <= 10.7.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:40:35.474638Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:40:56.605Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119708'
references:
  - url: 'https://github.com/colinin/abp-next-admin/pull/1633'
    label: 'Pull Request #1633'
  - url: >-
      https://github.com/colinin/abp-next-admin/commit/3ea383093d51b18984652fc9b2d3dcc779a372ee
    label: Patch Commit
  - url: 'https://github.com/colinin/abp-next-admin'
  - url: 'https://github.com/colinin/abp-next-admin/issues/1628'
  - url: >-
      https://github.com/colinin/abp-next-admin/commit/fc5e6d5a8a11a65e06fe001fe4a55e414956fc0c
  - url: >-
      https://github.com/colinin/abp-next-admin/blob/10.7.0/aspnet-core/modules/blob-management/LINGYUN.Abp.BlobManagement.Application/LINGYUN/Abp/BlobManagement/BlobAppService.cs#L60-L68
  - url: >-
      https://hackmd.io/@hieuPenguinnn/abp-next-admin-blob-download-by-name-cross-tenant-idor
  - url: >-
      https://www.vulncheck.com/advisories/abp-next-admin-10.4.0-through-10.7.0-cross-tenant-file-disclosure-via-blob-download-by-name
    label: >-
      VulnCheck Advisory: abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File
      Disclosure via Blob Download-By-Name
tags:
  - cve.org
  - exploit-available
epss: 0.00296
epssPercentile: 0.22349
ingestedAt: '2026-11-05T16:07:30.391Z'
---

## Overview

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.

## Affected

- `abp-next-admin >= 10.4.0 <= 10.7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.