CVE-2026-119659 Blossom through 1.17.1 Authorization Bypass via Folder Endpoints

🗓️ 30 Oct 2026 14:16:20Reported by VulnCheckType

Authorization bypass in Blossom through allows authenticated users to access other folders.

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2026-119659	30 Oct 202607:16	–	circl
CVE	CVE-2026-119659	30 Oct 202614:16	–	cve
EUVD	EUVD-2026-114075	30 Oct 202614:16	–	euvd
NVD	CVE-2026-119659	30 Oct 202615:16	–	nvd
Positive Technologies	PT-2026-133589	30 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-119659: blossom-editor Blossom: Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other…	30 Oct 202600:00	–	rapid7

[
  {
    "vendor": "blossom-editor",
    "product": "Blossom",
    "packageURL": "pkg:github/blossom-editor/blossom",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "1.17.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "repo": "https://github.com/blossom-editor/blossom"
  }
]

Source	Link
hackmd	www.hackmd.io/@hieuPenguinnn/blossom-folder-idor-cross-user-modify-delete
github	www.github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/resources/mapper/FolderMapper.xml
github	www.github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/folder/FolderService.java
github	www.github.com/blossom-editor/blossom/issues/213
vulncheck	www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-folder-endpoints
github	www.github.com/blossom-editor/blossom

30 Oct 2026 14:16Current

CVSS 45.3

CVSS 3.15.4

EPSS0.00263

CWE-639