CVE-2026-110775 Details

A missing authorization vulnerability has been identified in Nexent versions through 2.7.0. This vulnerability exists in the 'check_file_access' function, allowing authenticated users to read knowledge-base files belonging to other tenants. The issue arises from the absence of tenant comparison in the authorization process for knowledge-base read operations. In multi-tenant deployments, this flaw enables users to list objects through the '/file/storage' endpoint, obtaining presigned URLs, or to download source documents from other tenants via the '/file/download/{object_name}' endpoint.

The vulnerability can be fixed by modifying the 'check_file_access' function to include tenant ownership verification for read operations, similar to the existing checks for write operations. Additionally, the knowledge-base files should be stored under tenant-specific prefixes to prevent cross-tenant access.