Nexent Cross-Tenant Knowledge-Base File Read via check_file_access
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Nexent through 2.7.0 has a missing authorization check in check_file_access. An authenticated user can read other tenants' knowledge-base files by skipping the tenant comparison for knowledge_base/ reads. In multi-tenant deployments, an attacker can list objects via GET /file/storage to obtain presigned URLs, or download other tenants' source documents through GET /file/download/{object_name}. The weakness is CWE-639, Authorization Bypass Through User-Controlled Key.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ModelEngine-Group | nexent | up to 2.7.0 | — | No fix listed | CNA |
- nexent VendorModelEngine-Group Affected up to 2.7.0 Fixed in — No fix listed CNA
Remediation
No fixed version is listed for Nexent through 2.7.0. Until a fix is released, restrict multi-tenant access to Nexent and review who can reach the file storage and download endpoints.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-15 Threatist record created from CVE-2026-110775
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Priority changed: LOW → MEDIUM
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences