CVE-2026-119648
mediumTencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses…
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/TencentBlueKing/bk-cmdb disclosure@vulncheck.com
- https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/ac/parser/host.go#L797... disclosure@vulncheck.com
- https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_serv... disclosure@vulncheck.com
- https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_serv... disclosure@vulncheck.com
- https://github.com/TencentBlueKing/bk-cmdb/issues/8709 disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/bk-cmdb-host-search-asstdetail-cross-business-missing-aut... disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/blueking-cmdb-through-3.14.6-missing-authorization-vi... disclosure@vulncheck.com