MEDIUM 5.3 NVD
CVE-2026-119648
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.
References
- https://github.com/TencentBlueKing/bk-cmdb
- https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/ac/parser/host.go#L797
- https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_serv
- https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_serv
- https://github.com/TencentBlueKing/bk-cmdb/issues/8709
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.