CVE-2026-119648
BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.
| CWE | CWE-862 |
| Vendor | tencentblueking |
| Product | bk-cmdb |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for tencentblueking bk-cmdb
Be the first to know when new medium vulnerabilities affecting tencentblueking bk-cmdb are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
TencentBlueKing / bk-cmdb
0 ≤ 3.14.6
References
github.com: https://github.com/TencentBlueKing/bk-cmdb/issues/8709 github.com: https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/service/host.go#L605-L620 github.com: https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/ac/parser/host.go#L797-L819 github.com: https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/logics/hostsearch.go#L36-L72 hackmd.io: https://hackmd.io/@hieuPenguinnn/bk-cmdb-host-search-asstdetail-cross-business-missing-authz github.com: https://github.com/TencentBlueKing/bk-cmdb vulncheck.com: https://www.vulncheck.com/advisories/blueking-cmdb-through-3.14.6-missing-authorization-via-api-v3-hosts-search-asstdetail
Credits
hieuPenguinnn