{"id":"CVE-2026-119659","kind":"vulnerability","aliases":["CVE-2026-119659"],"related":[],"title":"Blossom: authenticated users can read, rename or delete other users' folders","description":"Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.","summary":"Blossom through 1.17.1 lets a logged-in user pass another user's folder id to its folder endpoints because the lookup filters only on the id. An attacker can read storage paths, rename folders, change visibility, or delete another user's folders.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["blossom","other","self-hosted"],"not_affected_if":["single-user-instance"],"how_to_check":"- Check the installed Blossom version; the sources say versions through 1.17.1 are affected.\n- Review whether `/folder/info`, `/folder/upd`, `/folder/open` and `/folder/del` are reachable by ordinary user accounts.","fix":null,"status":"open","published_at":"2026-10-30T15:16:50+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:34+00:00","updated_at":"2026-10-30T15:33:34+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T15:33:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Blossom: authenticated users can read, rename or delete other users' folders","impact":"medium","summary":"Blossom through 1.17.1 lets a logged-in user pass another user's folder id to its folder endpoints because the lookup filters only on the id. An attacker can read storage paths, rename folders, change visibility, or delete another user's folders.","audience":"businesses","category":"other","nicknames":[],"who_cares":["blossom","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Another user's folders are deleted, renamed or exposed","analyst_note":"Confirm the affected Blossom version range and whether a fixed release exists; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119659 was the only source given.","how_to_check":"- Check the installed Blossom version; the sources say versions through 1.17.1 are affected.\n- Review whether `/folder/info`, `/folder/upd`, `/folder/open` and `/folder/del` are reachable by ordinary user accounts.","plain_action":"","needs_analyst":true,"not_affected_if":["single-user-instance"],"who_is_affected":"Deployments of Blossom at version 1.17.1 or earlier where more than one user has an account can be affected, since the flaw lets one authenticated user act on another user's folders. The sources do not say whether single-user or default configurations are exposed, so the team should confirm who holds accounts on the instance.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4142,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119659':14A,17A '-2026':13A,16A '/folder/del':104C '/folder/info':100C '/folder/open':102C '/folder/upd':101C '1.17.1':25B,68C 'access':79C 'allow':75C 'anoth':33B,62B,94C 'attack':51B,91C 'authent':2A,76C 'author':71C 'blossom':1A,18B,23B,66C 'bypass':72C 'chang':58B 'contain':69C 'cve':12A,15A 'delet':8A,61B,113C 'endpoint':41B 'filter':45B,86C 'folder':11A,36B,40B,57B,65B,82C,89C,97C,114C 'folderservic':84C 'host':22B 'id':37B,49B,90C,98C 'let':26B 'log':29B 'logged-in':28B 'lookup':44B 'pass':32B 'path':55B,108C 'queri':85C 'read':5A,53B,106C 'renam':6A,56B,109C 'self':21B 'self-host':20B 'storag':54B,107C 'suppli':93C 'toggl':110C 'user':3A,10A,31B,34B,63B,77C,81C,95C 'visibl':59B,111C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Blossom at version 1.17.1 or earlier where more than one user has an account can be affected, since the flaw lets one authenticated user act on another user's folders. The sources do not say whether single-user or default configurations are exposed, so the team should confirm who holds accounts on the instance.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119659","severity":null,"published_at":"2026-10-30T15:16:50+00:00","modified_at":"2026-10-30T15:16:50+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}