Nexent CVE-2026-110775

Requires a multi-tenant Nexent deployment (through 2.7.0) and a valid authenticated account on that instance (PR:L) - the flaw does not grant initial access, it escalates a legitimate tenant to read other tenants' data. The specific trigger is reading objects under the knowledge_base/ path, for which check_file_access skips the tenant-ownership comparison; abuse is via GET /file/storage (to list objects / obtain presigned URLs) or GET /file/download/{object_name}. Limiting factors: single-tenant or non-shared deployments are not meaningfully exposed, exploitation is confined to knowledge-base file reads (confidentiality only - no write or deletion), and the attacker must already possess tenant credentials. No user interaction is required.

This is a cross-tenant authorization flaw (CWE-639) in Nexent's check_file_access, where tenant comparison is skipped for knowledge_base/ reads, letting any authenticated tenant read other tenants' knowledge-base source documents. The provided CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H, VI:N/VA:N) correctly frames this as a network-reachable, low-complexity, low-privilege confidentiality-only issue - no integrity or availability impact - yielding 7.1. The key limiting signal is PR:L: exploitation requires a valid authenticated account on a multi-tenant deployment, so this is not a remote-unauthenticated break. No EPSS score, no CISA KEV listing, and no POC flag were provided in the input, so there is no evidence of active or at-scale exploitation; however, a detailed public technical writeup (hackmd) and a VulnCheck advisory describe the mechanism precisely, which materially lowers the effort to reproduce. Net: a genuine, credible data-confidentiality priority for anyone running Nexent as a shared multi-tenant service, but real-world risk is bounded by the niche deployment footprint and the authenticated-tenant precondition rather than being a mass-exploitable internet threat.

An attacker signs up for or already holds a low-privilege account in a shared multi-tenant Nexent instance (≤2.7.0). They call GET /file/storage to enumerate knowledge-base objects belonging to other tenants and obtain presigned URLs, or directly call GET /file/download/{object_name} to retrieve another tenant's source documents. A public technical writeup describing the exact endpoints and the skipped tenant check exists, so reproduction is low-effort even though no packaged exploit was indicated in the input.