CVE-2026-110775: Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-16
Weakness: CWE-639

Description

Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.

Affected products

ModelEngine-Group nexent: through 2.7.0

References

https://github.com/ModelEngine-Group/nexent
https://github.com/ModelEngine-Group/nexent/blob/90bf1a5dbb1eb16bb4a28c2407ed4b6eda9a09bf/backend/services/file_management_service.py#L177
https://hackmd.io/@hieuPenguinnn/nexent-knowledge-base-cross-tenant-file-read
https://www.vulncheck.com/advisories/nexent-through-2.7.0-cross-tenant-knowledge-base-file-read-via-check-file-access

Get alerted when CVE-2026-110775 or the next vulnerability affects your stack