Description

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.

Related CPE's

Could not find any relations

References

https://github.com/blossom-editor/blossom

https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/folder/FolderService.java#L123-L202

https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/resources/mapper/FolderMapper.xml#L64-L92

https://github.com/blossom-editor/blossom/issues/213

https://hackmd.io/@hieuPenguinnn/blossom-folder-idor-cross-user-modify-delete

https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-folder-endpoints

Weaknesses

[email protected]

Primary
CWE-639

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.4 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-30T15:16:50.033Z

5 hours ago

Last modified

2026-10-30T19:23:25.493Z

1 hour ago