CVE-2026-119708

EUVD-2026-114113
abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/colinin/abp-next-admin
https://github.com/colinin/abp-next-admin/blob/10.7.0/aspnet-core/modules/blob-management/LINGYUN.Abp.BlobManagement.Application/LINGYUN/Abp/BlobManagement/BlobAppService.cs#L60-L68
https://github.com/colinin/abp-next-admin/commit/3ea383093d51b18984652fc9b2d3dcc779a372ee
https://github.com/colinin/abp-next-admin/commit/fc5e6d5a8a11a65e06fe001fe4a55e414956fc0c
https://github.com/colinin/abp-next-admin/issues/1628
https://github.com/colinin/abp-next-admin/pull/1633
https://hackmd.io/@hieuPenguinnn/abp-next-admin-blob-download-by-name-cross-tenant-idor
https://www.vulncheck.com/advisories/abp-next-admin-10.4.0-through-10.7.0-cross-tenant-file-disclosure-via-blob-download-by-name