CVE-2026-110775: Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access
Nexent through 2.7.0 contains a missing authorization vulnerability in checkfileaccess that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledgebase/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{objectname} to download other tenants' source documents.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Multi-tenant Nexent deployments are exposed if they run version 2.7.0 or earlier and store knowledge-base files. An authenticated user in one tenant may be able to access source documents belonging to another tenant.
What does an attacker need to exploit it?
The attacker needs valid authentication to Nexent; no user interaction is required. They can request GET /file/storage to obtain presigned URLs for objects or use GET /file/download/{object_name} to retrieve another tenant's source document.
Is the impact limited to file metadata?
No. The issue allows cross-tenant reading of knowledge-base source documents, affecting confidentiality. The provided information does not indicate that the attacker can modify or delete files.
How can I assess whether exploitation may have occurred?
Review requests to GET /file/storage and GET /file/download/{object_name}, particularly requests by a tenant for object names or downloads associated with another tenant's knowledge base. The provided information does not identify any additional detection indicators.