https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-02T12:15:35.725077+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-119708 CVE-2026-119708 — abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name 2026-11-02T12:15:35.726854+00:00

Affected: colinin abp-next-admin

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.