Live › vulnerability › CVE-2026-119659
Blossom through 1.17.1 lets a logged-in user pass another user's folder id to its folder endpoints because the lookup filters only on the id. An attacker can read storage paths, rename folders, change visibility, or delete another user's folders.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Deployments of Blossom at version 1.17.1 or earlier where more than one user has an account can be affected, since the flaw lets one authenticated user act on another user's folders. The sources do not say whether single-user or default configurations are exposed, so the team should confirm who holds accounts on the instance.
No product ranges from the sources yet.
/folder/info, /folder/upd, /folder/open and /folder/del are reachable by ordinary user accounts.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.
This page as .md · .json · in your agent: get_signal("CVE-2026-119659")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.