Cross-Tenant Authorization Bypass in abp-next-admin by Kolinin

CVE-2026-119708

What is CVE-2026-119708?

The abp-next-admin versions 10.4.0 through 10.7.0 contain a security flaw that enables authenticated users to bypass cross-tenant authorization. This vulnerability allows users to read files belonging to other tenants through the BlobManagement download-by-name endpoint. By manipulating the request path to include a victim's tenantId, attackers can invoke the DownloadByNameAsync method and retrieve blobs that should be inaccessible to them, potentially leading to sensitive information exposure. It is crucial for administrators using these affected versions to implement the patches provided in recent updates to safeguard against unauthorized access to tenant files.

References