Authorization Bypass in Blossom Allows Access to Users' Folders

CVE-2026-119659

What is CVE-2026-119659?

Blossom version 1.17.1 experiences an authorization bypass vulnerability that allows authenticated users to access folders belonging to other users. This occurs because the FolderService's filtering mechanism only queries based on folder ID, permitting attackers to manipulate folder IDs in API calls to access, modify, or delete unauthorized folder content. Using endpoints such as /folder/info, /folder/upd, /folder/open, and /folder/del, an attacker could read storage paths, rename folders, toggle their visibility, or even delete them altogether. This flaw poses significant risks to data confidentiality and integrity within the application.

References