CVE-2026-110775

Deferred Deferred - Pending Action

Nexent Missing Authorization in File Access Leading to Tenant Data Exposure

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110775

EUVD

EUVD-2026-101575

Affected Vendors & Products

Vendor	Product	Version / Range
ModelEngine-Group	nexent	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-110775 is a missing authorization vulnerability in Nexent through version 2.7.0. It allows authenticated users in multi-tenant deployments to read files belonging to other tenants by bypassing tenant comparison checks for knowledge-base files. The flaw exists in the check_file_access function, which incorrectly grants access to all files under the knowledge_base/ prefix regardless of tenant ownership.

Detection Guidance

To detect this vulnerability, inspect network traffic for unauthorized access attempts to /file/storage or /file/download/{object_name} endpoints. Check MinIO storage logs for cross-tenant file access patterns under knowledge_base/ prefixes. Review file management service logs for failed authorization checks in check_file_access.

Impact Analysis

This vulnerability enables cross-tenant information disclosure. Attackers can list and download other tenants' knowledge-base files, exposing sensitive documents like internal or proprietary files. It does not allow write or delete operations but compromises data confidentiality in multi-tenant deployments.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized cross-tenant data access. It enables data breaches that could expose protected health information or personal data, leading to regulatory penalties, loss of trust, and potential legal consequences for affected organizations.

Mitigation Strategies

Immediately upgrade Nexent to a patched version beyond 2.7.0. If upgrading is not possible, restrict access to /file/storage and /file/download endpoints via network policies. Implement tenant-specific access controls in file management service and audit all knowledge_base/ file accesses.

Hi! I’m here to help you understand CVE-2026-110775. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70