CVE-2026-119648

BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail

State: Published
Severity: 5.3 Medium
Published: Oct 30, 2026
Updated: Oct 30, 2026
Reserved: Oct 30, 2026

Description

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
bk-cmdbTencentBlueKing	3.14.6 and earlierAffected

References

https://github.com/TencentBlueKing/bk-cmdb/issues/8709issue-tracking
https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/service/host.go#L605-L620technical-description
https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/ac/parser/host.go#L797-L819technical-description
https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/logics/hostsearch.go#L36-L72technical-description
https://hackmd.io/@hieuPenguinnn/bk-cmdb-host-search-asstdetail-cross-business-missing-authzthird-party-advisory
https://github.com/TencentBlueKing/bk-cmdbproduct
VulnCheck Advisory: BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetailthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.