EUVD-2026-114075
GHSA-g885-v5xm-xh6q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Blossom user
-
ExploitEnumerate or guess another user's folder id
-
ExecutionCall /folder/info, /folder/upd, or /folder/del with that id
-
ImpactRead storage paths, rename, toggle visibility, or delete victim's folders
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated Blossom account (PR:L) - the attacker must already be a registered, logged-in user of the target instance; it is not remote-unauthenticated. Given that account, the attacker supplies another user's folder id to the /folder/info, /folder/upd, /folder/open, or /folder/del endpoints, which FolderService authorizes using only the folder id with no owner check. Limiting factors: exploitation needs authentication and knowledge of a victim's folder id (though sequential/guessable ids would make enumeration trivial); impact is confined to folder metadata operations (reading storage paths, renaming, visibility toggling, deletion) on a multi-user Blossom deployment through version 1.17.1, so single-user instances have no cross-user victim. |
| Impact | This is a medium-severity, authenticated authorization bypass (IDOR, CWE-639), not a critical remote issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score agree that exploitation is network-reachable and low-complexity but requires an existing low-privileged account (PR:L) and no user interaction, with only Low confidentiality and Low integrity impact to the vulnerable system (VC:L/VI:L) and no availability or subsequent-system impact. The vuln.today decision label is this_month rather than act_now or emergency, consistent with a non-critical, auth-gated flaw. The CVE is not listed in CISA KEV and no EPSS exploitation-probability score was supplied, so there is no signal of widespread or automated exploitation; a public technical write-up (hackmd) and GitHub issue reference exist but are not confirmed as working weaponized exploit code. Net: a genuine multi-tenant data-exposure and data-tampering bug worth remediating on a normal patch cycle, but not a drop-everything emergency - the main amplifier is that Blossom appears to use guessable folder ids, lowering the practical barrier for any authenticated user. |
| Exploit ScenarioDerived | An attacker who already holds a valid low-privileged Blossom account logs in, then enumerates or guesses another user's folder id and submits it to /folder/info, /folder/upd, /folder/open, or /folder/del. Because FolderService filters only on folder id and not on owner, the attacker reads another user's storage paths, renames or toggles the visibility of their folders, or deletes them outright. A public PoC reference (a hackmd write-up and GitHub issue #213) describes this cross-user modify/delete behavior, though it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
An authenticated authorization bypass (IDOR) in Blossom through 1.17.1 lets any registered user act on folders belonging to other users by supplying a foreign folder id to the /folder/info, /folder/upd, /folder/open or /folder/del endpoints, exposing storage paths, enabling renames, visibility toggling and deletion. Exploitation requires a valid account on a multi-user instance (PR:L, per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) plus knowledge of a victim's folder id; single-user deployments have no cross-user victim. The result is a medium-severity integrity and confidentiality issue scoped to folder metadata rather than a critical remote compromise, and no public working exploit code was identified at time of analysis, though a public technical write-up reference exists.
RemediationAI
No vendor-released patch or fixed version is identified in the available data; the references point to the upstream issue (https://github.com/blossom-editor/blossom/issues/213) and the vulnerable source rather than to a tagged fix release, so confirm with the project at https://github.com/blossom-editor/blossom whether a build newer than 1.17.1 corrects the queries before relying on an upgrade. The underlying repair is to add an owner/user predicate to the FolderService and FolderMapper.xml statements so folder id is never the sole authorization key, and to return 404 or 403 for folders not owned by the caller. Until a fixed build is available, run Blossom as a single-user instance or keep the user base fully trusted, because the flaw needs only one registered account plus a victim folder id and gives no benefit without a second user's data; alternatively place the /folder/info, /folder/upd, /folder/open and /folder/del endpoints behind a reverse proxy or API gateway with per-user access controls, accepting that any shared-account or trusted-proxy configuration reintroduces the exposure. Note that folder ids appear to be low-entropy sequential values, so treating ids as unguessable is not a reliable control, and detecting abuse requires monitoring for folder operations where the requested id does not belong to the requesting session's user.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Blossom is a Java/Spring Boot file and blog asset manager whose backend persists folder records through a MyBatis mapper. The vulnerable code path is the FolderService implementation shipped in v1.17.1 and the accompanying FolderMapper.xml statements: the lookup and mutation queries are keyed only on the folder id and omit an owner/user predicate, so the identity of the caller is never correlated with the ownership of the folder row. This is a classic CWE-639 authorization bypass through a user-controlled key - the object reference (folder id) is trusted as the sole authorization token. Because the four REST endpoints (/folder/info, /folder/upd, /folder/open, /folder/del) all route through these id-only queries, a logged-in user can read another user's storage path, rename their folder, toggle its visibility, or delete it. The omission is at the SQL/persistence layer rather than in the controller, which means any endpoint reusing these mapper statements inherits the same gap.
Know when Blossom gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoints exploitable by any authenticated low-privileged user (PR:L, AC:L, no UI); folder metadata disclosure gives C:L and rename/visibility/delete gives I:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Path traversal in Blossom up to version 1.17.1 file upload functionality allows authenticated remote attackers to access
A vulnerability was detected in Blossom up to 1.17.1. This vulnerability affects the function content of the file blosso
Blossom through 1.17.1 fails to verify picture ownership on its picture delete, /picture/del/batch and /picture/star end
Exploit-DB