Tencent BlueKing CMDB (bk‑cmdb) through version 3.14.6 contains a missing authorization flaw that allows any authenticated user to view hosts belonging to other businesses via the POST /api/v3/hosts/search/asstdetail endpoint. The flaw arises because the route is mapped to SkipAction and the underlying search routine bypasses the AuthorizeSearchHost check, resulting in an access‑control bypass (CWE‑862). As a result, attackers can request host search conditions that target foreign business IDs or omit business filters and receive sensitive host attributes and topology information for those external businesses, thereby exposing confidential operational data. Based on the description, it is inferred that the vulnerability requires the attacker to have valid authentication credentials, but no extra privileges are needed beyond normal user access.

The affected product is Tencent BlueKing’s Configuration Management Database (CMDB) with the identifier bk‑cmdb. All releases through version 3.14.6 are impacted; versions equal to or older than 3.14.6 should be considered vulnerable. Any deployment of these releases that exposes the API endpoint to internal users is subject to the flaw.

The CVSS score of 5.3 indicates a moderate severity risk. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not known to have widespread exploitation at this time. Nonetheless, the attack vector is an authenticated internal user, so any compromised account or malicious insider can leverage the flaw. The potential impact is confidentiality leakage across business boundaries, which could enable attackers to gather sensitive infrastructure details, plan further attacks, or exfiltrate data. The absence of an EPSS score means the exploitation probability cannot be quantified, but the typical exploitation scenario would involve a legitimate user simply submitting a specially crafted request to the endpoint without additional attack stages.