CVE-2026-119659

CVSS 5.4 (medium) · published 2026-10-30

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.

Weakness: CWE-639

Source: NVD CVE-2026-119659

References

• https://github.com/blossom-editor/blossom
• https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/folder/FolderService.java#L123-L202
• https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/resources/mapper/FolderMapper.xml#L64-L92
• https://github.com/blossom-editor/blossom/issues/213
• https://hackmd.io/@hieuPenguinnn/blossom-folder-idor-cross-user-modify-delete
• https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-folder-endpoints

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.