Abp-next-admin from version 10.4.0 through 10.7.0 contains an authorization bypass in the Blob Management download-by-name endpoint that allows an authenticated user to retrieve files belonging to another tenant. This flaw is a type of Information Disclosure due to Broken Access Control (CWE-639). By including the victim tenant’s identifier in the request path, the DownloadByNameAsync operation switches tenant context and returns the specified blob, thereby exposing confidential data across tenant boundaries.

The vulnerability affects the colinin:abp-next-admin web application for all releases from 10.4.0 up to and including 10.7.0. No specific patched release is listed in the data, but any instance running within that version range is impacted.

The CVSS score of 7.1 indicates a high severity, and while the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. The attack vector requires authentication; an attacker who gains legitimate user access can choose any tenant identifier in the URL, leading to a tenant‑context switch that results in unauthorized file disclosure. Because the flaw is present in core business logic, exploitation should be straightforward for an authenticated user with limited permissions, making the threat significant for multi‑tenant deployments.