SZB-a69c4d0e55
EUVD lists cross-tenant authorization bypass in abp-next-admin 10.4.0–10.7.0
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- colinin
- Product
- abp-next-admin
- First seen
Summary
The EUVD database entry EUVD-2026-114113 (CVSS v3.1 score 7.1) describes a cross-tenant authorization bypass in abp-next-admin's BlobManagement download-by-name endpoint. According to the entry, authenticated users can read other tenants' files by supplying a victim tenantId in the request path.
If you use colinin
Upgrade abp-next-admin to a release later than 10.7.0 once confirmed
Review the BlobManagement download endpoint's tenant checks
Check logs for download requests that reference other tenant IDs
What the sources say 1
· Mastodon: “abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files.” Source