---
id: "CVE-2026-119659"
kind: "vulnerability"
aliases: ["CVE-2026-119659"]
title: "Blossom: authenticated users can read, rename or delete other users' folders"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["blossom", "other", "self-hosted"]
not_affected_if: ["single-user-instance"]
published_at: "2026-10-30T15:16:50+00:00"
first_seen_at: "2026-10-30T15:31:10+00:00"
updated_at: "2026-10-30T15:33:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119659", "first_seen_at": "2026-10-30T15:31:10+00:00"}]
---

# Blossom: authenticated users can read, rename or delete other users' folders

Blossom through 1.17.1 lets a logged-in user pass another user's folder id to its folder endpoints because the lookup filters only on the id. An attacker can read storage paths, rename folders, change visibility, or delete another user's folders.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Blossom version; the sources say versions through 1.17.1 are affected.
- Review whether `/folder/info`, `/folder/upd`, `/folder/open` and `/folder/del` are reachable by ordinary user accounts.

## Timeline

- 2026-10-30T15:31:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119659

## From the sources

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_