abp-next-admin CVE-2026-119708

Exploitation requires (1) a valid authenticated account on the target instance (CVSS PR:L - any low-privileged tenant user, not an anonymous attacker), and (2) that the deployment actually runs in multi-tenant mode with more than one tenant storing blobs, since the attack reads across tenant boundaries. The concrete trigger is supplying a victim tenantId in the BlobManagement download-by-name request, which causes DownloadByNameAsync to switch tenant context; the attacker must know or guess the target blob name and the victim tenantId. Limiting factors: authentication is mandatory, impact is confined to file/blob confidentiality disclosure (no write or denial-of-service), only versions 10.4.0 through 10.7.0 are affected, and single-tenant deployments have no cross-tenant data to expose.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) and the description agree internally: this is a network-reachable, low-complexity flaw requiring low-level authentication (PR:L - any valid, logged-in tenant user) with high confidentiality impact and no integrity or availability impact, consistent with CWE-639 (authorization bypass through a user-controlled tenantId key). Signals are coherent rather than conflicting: VulnCheck published an advisory, a vendor patch exists (PR #1633 with two fix commits), and a detailed HackMD technical writeup is referenced, so the mechanism is well documented. However, no EPSS score and no KEV listing are provided in the input, and there is no confirmation of active exploitation, so this is not a confirmed in-the-wild threat. The vuln.today decision label is 'this_week' - a meaningful-but-not-emergency priority - which fits the profile: a real, easily-reproduced IDOR in a self-hosted multi-tenant admin framework, gated behind authentication and limited to file disclosure. This is a genuine priority for anyone running abp-next-admin in a multi-tenant deployment (tenant isolation is a core security boundary), but the authentication requirement and confidentiality-only impact keep it below critical. The main uncertainty is real-world footprint rather than technical validity.

An attacker registers or already holds a low-privileged account in one tenant of an abp-next-admin (10.4.0-10.7.0) deployment, then calls the BlobManagement download-by-name endpoint while substituting a different (victim) tenantId into the request. DownloadByNameAsync switches tenant context to the attacker-supplied value and returns blobs belonging to that tenant, disclosing other tenants' files. A public PoC reference exists (HackMD writeup and VulnCheck advisory); it is not verified as working exploit code.