{"id":"CVE-2026-119648","kind":"vulnerability","aliases":["CVE-2026-119648"],"related":[],"title":"Tencent BlueKing CMDB: authenticated users can view other businesses' hosts","description":"Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.","summary":"Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 has a missing authorization check on the host search endpoint POST /api/v3/hosts/search/asstdetail. A logged-in user can read host attributes and topology details belonging to other businesses.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bk-cmdb","package","self-hosted","tencent-blueking"],"not_affected_if":["no-untrusted-authenticated-users","single-business-deployment"],"how_to_check":"- Look at the installed bk-cmdb version and compare it with `3.14.6`\n- Check whether the route `/api/v3/hosts/search/asstdetail` is reachable by non-admin users on your instance\n- Review access logs for POST requests to `/api/v3/hosts/search/asstdetail` with business filters you do not expect","fix":null,"status":"open","published_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:44+00:00","updated_at":"2026-10-30T15:33:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T15:33:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Tencent BlueKing CMDB: authenticated users can view other businesses' hosts","impact":"medium","summary":"Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 has a missing authorization check on the host search endpoint POST /api/v3/hosts/search/asstdetail. A logged-in user can read host attributes and topology details belonging to other businesses.","audience":"businesses","category":"package","nicknames":[],"who_cares":["bk-cmdb","self-hosted","tencent-blueking"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads host data of other businesses","analyst_note":"Find the upstream fixed version and advisory for bk-cmdb beyond 3.14.6 (check the NVD link and the Tencent BlueKing GitHub repository).","how_to_check":"- Look at the installed bk-cmdb version and compare it with `3.14.6`\n- Check whether the route `/api/v3/hosts/search/asstdetail` is reachable by non-admin users on your instance\n- Review access logs for POST requests to `/api/v3/hosts/search/asstdetail` with business filters you do not expect","plain_action":"","needs_analyst":true,"not_affected_if":["single-business-deployment","no-untrusted-authenticated-users"],"who_is_affected":"Exposure requires a running bk-cmdb instance through version 3.14.6 with multiple businesses configured and at least one authenticated user who should not see every business. Single-business deployments or instances where all users are trusted are less exposed. The sources do not state a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4199,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119648':13A,16A '-2026':12A,15A '/api/v3/hosts/search/asstdetail':46B,88C '3.14.6':34B,70C 'allow':77C 'associ':108C 'attack':89C 'attribut':55B,105C 'authent':4A,78C 'author':38B,74C 'authorizesearchhost':120C 'belong':59B 'bk':18B,31B,67C 'bk-cmdb':17B,30B,66C 'bluek':2A,26B,28B,64C 'busi':9A,62B,85C,97C,100C 'check':39B 'cmdb':3A,19B,29B,32B,65C,68C 'condit':94C 'contain':71C 'cve':11A,14A 'detail':58B,109C 'endpoint':44B 'filter':101C 'host':10A,23B,42B,54B,82C,92C,104C 'log':49B 'logged-in':48B 'map':114C 'miss':37B,73C 'omit':99C 'packag':20B 'post':45B,87C 'read':53B 'retriev':103C 'rout':112C 'search':43B,93C 'searchhostwithasstdetail':118C 'self':22B 'self-host':21B 'skip':119C 'skipact':116C 'submit':91C 'target':95C 'tencent':1A,25B,27B,63C 'tencent-bluek':24B 'topolog':57B,107C 'user':5A,51B,79C 'via':86C 'view':7A,81C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires a running bk-cmdb instance through version 3.14.6 with multiple businesses configured and at least one authenticated user who should not see every business. Single-business deployments or instances where all users are trusted are less exposed. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119648","severity":null,"published_at":"2026-10-30T15:16:48+00:00","modified_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}