CVE-2026-119708

MediumCVSS 6.5

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint. An authenticated user can supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.

Risk Assessment

An authenticated user from one tenant can read files belonging to other tenants, resulting in data leakage and a breach of multi-tenant isolation.

Recommendation

Upgrade abp-next-admin to a version later than 10.7.0 and verify that the download endpoint enforces the logged-in user's tenant context.

Other vulnerabilities in abp-next-admin

CVE-2026-111630Medium
abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call ChatAppService.GetListAsync or SendMessageAsync with a victim's ConversationId GUID to read chat messages and inject messages into that conversation.

Original NVD description (English source)

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS