CVE-2026-110775 ModelEngine-Group CVE debrief

Who should care

Defenders responsible for Nexent deployments, especially those in multi-tenant environments, should be aware of this vulnerability. They should assess their exposure, prioritize patching or mitigation efforts, and monitor for potential suspicious activity related to file access and downloads.

Why it matters

CVE-2026-110775 is a high-severity vulnerability in Nexent that allows authenticated users to read other tenants' knowledge-base files. Defenders should prioritize verifying the presence of this vulnerability in their deployments and applying patches or mitigations as soon as possible.

• Potential unauthorized access to sensitive knowledge-base files
• Possible data leakage in multi-tenant deployments
• Need for verification of affected versions and deployment contexts
• Requirement for patching or applying compensating controls

Technical summary

The vulnerability exists in the check_file_access function of Nexent through version 2.7.0. It allows authenticated users to read knowledge-base files of other tenants by skipping tenant comparison for knowledge_base/ reads. This is particularly problematic in multi-tenant deployments, where attackers could use GET /file/storage for presigned URLs or GET /file/download/{object_name} to list and download files from other tenants.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their deployments and applying patches or mitigations as soon as possible. This involves reviewing the affected versions, assessing the deployment context, and implementing compensating controls if patches are not immediately available.

Recommended defensive actions

• Verify the presence of Nexent version 2.7.0 or earlier in your environment
• Assess the deployment context to determine if multi-tenancy is in use
• Apply patches or updates provided by the vendor as soon as possible
• Implement compensating controls, such as restricting access to knowledge-base files
• Monitor for suspicious activity related to file access and downloads

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and references to technical descriptions and exploit information. However, the corpus does not provide explicit information on exploitation or specific victim impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.