Live › vulnerability › CVE-2026-119708
abp-next-admin versions 10.4.0 through 10.7.0 have a flaw in the BlobManagement download-by-name endpoint. An authenticated user can supply another tenant's ID in the request path and download that tenant's stored files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Multi-tenant applications built on abp-next-admin 10.4.0 through 10.7.0 that expose the BlobManagement download endpoint to logged-in users are exposed. Single-tenant deployments or applications that do not use BlobManagement are not affected by this description.
No product ranges from the sources yet.
package.json or .csproj) for versions 10.4.0 through 10.7.010.7.0 (the sources do not name the exact fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.
This page as .md · .json · in your agent: get_signal("CVE-2026-119708")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.