CVE-2026-119708— abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name

Quick assessment

Affected

colinin abp-next-admin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

abp-next-admin 10.4.0 至 10.7.0 版本在 BlobManagement 的“按名称下载”（download-by-name）接口中存在跨租户授权绕过漏洞，允许已认证用户读取其他租户的文件。攻击者通过在请求路径中提供目标租户 ID（tenantId），可触发 DownloadByNameAsync 方法切换租户上下文，从而获取该租户存储的 Blob 文件。

CVSS 6.5 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1548.003 · Sudo and Sudo Caching T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name

Source: CVE Program / CVE List V5

Vulnerability Description

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
colinin	abp-next-admin	10.4.0 ~ 10.7.0	-

II. Public POCs for CVE-2026-119708

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119708

请登录查看更多情报信息。

Other References for CVE-2026-119708 (8)

https://github.com/colinin/abp-next-admin product
https://hackmd.io/@hieuPenguinnn/abp-next-admin-blob-download-by-name-cross-tenant-idor third-party-advisory
https://github.com/colinin/abp-next-admin/issues/1628 issue-tracking
https://github.com/colinin/abp-next-admin/blob/10.7.0/aspnet-core/modules/blob-management/LINGYUN.Abp.BlobManagement.Application/LINGYUN/Abp/BlobManagement/BlobAppService.cs#L60-L68 technical-description
https://github.com/colinin/abp-next-admin/commit/fc5e6d5a8a11a65e06fe001fe4a55e414956fc0c patch
https://github.com/colinin/abp-next-admin/commit/3ea383093d51b18984652fc9b2d3dcc779a372ee patch
https://github.com/colinin/abp-next-admin/pull/1633 patch issue-tracking
https://www.vulncheck.com/advisories/abp-next-admin-10.4.0-through-10.7.0-cross-tenant-file-disclosure-via-blob-download-by-name third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119708

IV. Related Vulnerabilities

Same product: abp-next-admin

CVE-2026-111630
abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Ch

Same vendor: colinin

CVE-2026-111630
abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Ch

Same weakness: CWE-639