CVE-2026-110775 in Nexent
Summary
by MITRE • 10/14/2026
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Nexent versions through 2.7.0 represents a critical failure in access control mechanisms, specifically classified under CWE-862 Missing Authorization. This flaw resides within the check_file_access function, which is responsible for validating user permissions before granting access to stored resources. In multi-tenant software architectures, strict isolation between tenants is paramount to ensure data privacy and security. The core technical deficiency lies in the logic that governs file retrieval operations; specifically, the system fails to perform a necessary comparison of tenant identifiers when processing requests related to knowledge base files. By skipping this critical validation step, the application inadvertently allows authenticated users to bypass ownership checks, effectively treating all accessible resources as public within their own session context regardless of actual ownership boundaries.
From an operational perspective, this vulnerability enables significant data exfiltration by malicious actors who have obtained valid credentials for a legitimate user account in a multi-tenant environment. An attacker can exploit the GET /file/storage endpoint to list objects and generate presigned URLs that point to files belonging to other tenants. Furthermore, direct access via the GET /file/download/{object_name} endpoint allows for the immediate download of source documents stored within the knowledge base. This capability transforms a simple authentication breach into a severe confidentiality compromise, as sensitive proprietary information, internal documentation, or personal data from competing organizations can be systematically harvested without triggering standard security alerts associated with unauthorized access attempts.
The impact extends beyond mere data theft to include potential regulatory non-compliance and reputational damage for the service provider. Since the vulnerability relies on authenticated sessions, it may evade detection by basic intrusion detection systems that focus solely on unauthenticated requests or brute-force attacks. The ability to enumerate and download arbitrary files suggests a high severity rating under common scoring frameworks due to the ease of exploitation and the breadth of data exposure possible. Attackers do not require complex exploit chains; they only need valid credentials for any user account within the compromised tenant instance, making this vulnerability particularly dangerous in environments where credential sharing or weak password policies are prevalent.
Mitigation strategies must prioritize immediate patching to version 2.7.1 or later, which addresses the missing authorization check by enforcing strict tenant ID validation during file access operations. In addition to software updates, organizations should implement robust input validation and ensure that all API endpoints enforce multi-tenant isolation checks at the application logic layer rather than relying solely on database-level constraints. Security teams should also audit existing user permissions and consider implementing stricter role-based access controls to limit which users can interact with file storage APIs. Monitoring logs for unusual patterns of presigned URL generation or high-volume download requests from single IP addresses can provide early warning indicators of exploitation attempts while patches are being deployed across the infrastructure.