CVE-2026-119708

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context an...

EUVD-2026-114113

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context an...

CVE-2026-119708

The abp-next-admin versions 10.4.0 through 10.7.0 are vulnerable to a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint. This flaw allows authenticated users to access and read files belonging to other tenants by supplying a victim tenantId in the request path. The...

CVE-2026-119708 abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context an...

CVE-2026-119708 abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context an...

CVE-2026-119708: colinin abp-next-admin: abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement…

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context an...

PT-2026-133642

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context an...

CVE-2026-111630

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...

CVE-2026-111630 abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...

CVE-2026-111630

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...

CVE-2026-111630 abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...

EUVD-2026-103052

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...

CVE-2026-111630 abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...

CVE-2026-111630

The abp-next-admin software (versions 10.2.0 through 10.6.0 ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the LINGYUN.Abp.AIManagement module. The root cause allows authenticated users with the Chat permission to access other users' AI chat conversations by supplying ...

CVE-2026-111630: Authorization Bypass Through User-Controlled Key

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...

PT-2026-116029

🚨 CVE-2026-111630 abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat...

i2nets abp-next-admin Authorization Issue Vulnerability

In the i2nets abp-next-admin version from 10.2.0 to 10.6.0, there is an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the LINGYUN.Abp.AIManagement module. Certified users can access other users’ AI chat conversations by providing their...