CVE-2026-119659: Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
Published Oct 30, 2026
·Updated
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.
Event History
Oct 30, 2026
CVE Published
via MITRE·02:16 PM
Data Sourced
via MITRE·02:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated. They also need the folder ID of another user's folder to target the affected endpoints.
2
What can an attacker do with a targeted folder ID?
They can use /folder/info, /folder/upd, /folder/open, or /folder/del to access storage paths, rename the folder, change its visibility, or delete it.
3
Which Blossom versions are in scope?
Blossom versions through 1.17.1 are affected according to the available information.