CVE-2026-119659
Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.
| CWE | CWE-639 |
| Vendor | blossom-editor |
| Product | blossom |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for blossom-editor blossom
Be the first to know when new medium vulnerabilities affecting blossom-editor blossom are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
blossom-editor / Blossom
0 ≤ 1.17.1
References
github.com: https://github.com/blossom-editor/blossom/issues/213 github.com: https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/folder/FolderService.java#L123-L202 github.com: https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/resources/mapper/FolderMapper.xml#L64-L92 hackmd.io: https://hackmd.io/@hieuPenguinnn/blossom-folder-idor-cross-user-modify-delete github.com: https://github.com/blossom-editor/blossom vulncheck.com: https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-folder-endpoints
Credits
hieuPenguinnn