A missing authorization check in Nexent's file access logic allows authenticated users to read other tenants' knowledge-base files. The flaw exists in the check_file_access function where a tenant comparison is skipped for knowledge_base reads. This enables an attacker to retrieve files that should be private to other tenants, resulting in the disclosure of potentially sensitive source documents, violating confidentiality.

The vulnerability affects ModelEngine-Group's Nexent platform version 2.7.0 and earlier. Any deployment using these versions in a multi‑tenant configuration is susceptible; the flaw is triggered when users access the /file/storage or /file/download endpoints to retrieve knowledge‑base contents.

The CVSS score of 7.1 indicates a medium severity with significant impact. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user but does not need elevation of privileges. The attacker can leverage routine API calls to enumerate and download files from other tenants, making the vulnerability a direct risk for confidentiality in multi‑tenant deployments.