Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-119708high7.1

abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name

Impact

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.

Source excerpt · VulnCheck

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

colinin · VulnCheck

abp-next-admin

1 range
VulnCheck version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

10.4.0 → through 10.7.0

semver versions

unaffected

unknown

Other versions: unaffected

Original source description

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-119708

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-639 ↗

Authorization Bypass Through User-Controlled Key

VulnCheck

Related →
Contributing organizations · 1
VulnCheck

Assigning organization

2026-10-30

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

8 sources
github.com/colinin/abp-next-admin/pull/1633
patchVulnCheck
github.com/colinin/abp-next-admin/commit/3ea383093d51b18984652fc9b2d3dcc779a372ee
patchVulnCheck
github.com/colinin/abp-next-admin/commit/fc5e6d5a8a11a65e06fe001fe4a55e414956fc0c
patchVulnCheck
github.com/colinin/abp-next-admin
productVulnCheck
github.com/colinin/abp-next-admin/issues/1628
issue-trackingVulnCheck
github.com/colinin/abp-next-admin/blob/10.7.0/aspnet-core/modules/blob-management/LINGYUN.Abp.BlobManagement.Application/LINGYUN/Abp/BlobManagement/BlobAppService.cs
technical-descriptionVulnCheck
View 2 more references
hackmd.io/@hieuPenguinnn/abp-next-admin-blob-download-by-name-cross-tenant-idor
third-party-advisoryVulnCheck
www.vulncheck.com/advisories/abp-next-admin-10.4.0-through-10.7.0-cross-tenant-file-disclosure-via-blob-download-by-name
third-party-advisoryVulnCheck