Blossom Authorization Bypass via Folder Endpoints
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Blossom through 1.17.1 contains an authorization bypass that lets authenticated users access other users' folders. The FolderService queries filter only on the folder id, so an attacker who supplies another user's folder id can read storage paths, rename, toggle visibility, or delete those folders through the folder endpoints. This is classified as CWE-639, authorization bypass through a user-controlled key. Exploitation requires low privileges over the network with no user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| blossom-editor | Blossom | up to 1.17.1 | — | No fix listed | CNA |
- Blossom Vendorblossom-editor Affected up to 1.17.1 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Blossom.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Timeline
- 2026-10-30 Threatist record created from CVE-2026-119659
- 2026-10-30 Alias added: GHSA-g885-v5xm-xh6q
- 2026-11-04 CISA SSVC decision points changed
References
Other 4
- https://github.com/blossom-editor/blossom/issues/213
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/folder/FolderService.java#L123-L202
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/resources/mapper/FolderMapper.xml#L64-L92
- https://github.com/blossom-editor/blossom
More blossom-editor vulnerabilities
- TI-2026-83118 Authorization bypass in Blossom lets users delete other users' pictures CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-119659 · CVE Program
- CVE-2026-119659 · NVD
- FIRST EPSS
- GHSA-g885-v5xm-xh6q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences