CVE-2026-119708 | colinin abp-next-admin up to 10.7.0 BlobManagement download-by-name endpoint DownloadByNameAsync tenantId authorization

October 30, 2026 Yanac

A vulnerability was found in colinin abp-next-admin up to 10.7.0. It has been declared as problematic. This vulnerability affects the function DownloadByNameAsync of the component BlobManagement download-by-name endpoint. Executing a manipulation of the argument tenantId can lead to authorization bypass.

This vulnerability is registered as CVE-2026-119708. It is possible to launch the attack remotely. No exploit is available.VulDB Recent EntriesRead More