Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119659Blossom through 1.17.1 Authorization Bypass via Folder Endpoints

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in Blossom from blossom-editor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 81.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.

Affected products (as reported)

Vendor	Product	Versions
blossom-editor	Blossom	0 – through 1.17.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/blossom-editor/blossom/issues/213 issue-tracking
https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/folder/FolderService.java#L123-L202 technical-description
https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/resources/mapper/FolderMapper.xml#L64-L92 technical-description
https://hackmd.io/@hieuPenguinnn/blossom-folder-idor-cross-user-modify-delete third-party-advisory
https://github.com/blossom-editor/blossom product
VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Folder Endpoints third-party-advisory