CVE-2026-122326 in Chevereto
Summary
by MITRE • 11/05/2026
Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded id can obtain image filenames, viewer and direct file URLs, and download private images.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Chevereto versions prior to 4.5.8 represents a critical authorization bypass within the application’s JSON API endpoint structure. Specifically, the flaw resides in the get-album-contents action associated with the /json route. This architectural weakness allows unauthenticated attackers or users with minimal privileges to circumvent intended access controls by directly manipulating input parameters. The core technical issue stems from insufficient server-side validation of ownership claims when processing requests for album contents. Instead of verifying that the requesting user session is explicitly linked to the requested resource, the application relies primarily on the presence of a valid session token and the structural validity of an encoded album identifier. This design oversight creates a direct path for unauthorized data access, fundamentally breaking the principle of least privilege by allowing any authenticated user, or potentially unauthenticated users if session handling is also flawed, to interact with resources they do not own.
From a technical perspective, the exploitation mechanism involves supplying another user’s encoded album ID within the request payload while possessing a valid session token from any public page interaction. The application fails to cross-reference this supplied identifier against the permissions associated with the current session context. Consequently, the server processes the request as legitimate and returns the requested data structure. This lack of object-level authorization checks means that the security boundary is defined solely by the visibility settings of the album rather than strict access control lists tied to user identities. The encoded ID serves merely as a pointer without cryptographic or logical binding to the requester’s identity, enabling horizontal privilege escalation where one user can effectively impersonate another in terms of data retrieval capabilities.
The operational impact of this vulnerability is severe due to the sensitivity of the exposed information. Successful exploitation allows attackers to enumerate private albums and extract detailed metadata including image filenames, viewer URLs, direct file download links, and potentially other embedded attributes. This exposure compromises the confidentiality of user-generated content that was intended to be restricted to specific audiences or owners alone. The availability of direct file URLs facilitates mass downloading of proprietary images, leading to significant intellectual property theft, privacy violations for end-users, and potential reputational damage for both the platform operators and individual users. Furthermore, the ability to list private albums can aid in further reconnaissance activities, allowing attackers to map out user networks or identify high-value targets within the application ecosystem.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure to enforce proper authorization checks on sensitive objects. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, as exploitation requires obtaining any valid session token, and potentially T1530 Data from Cloud Storage Object if the images are stored in external object storage services that become accessible via the leaked direct URLs. To mitigate this risk, immediate patching to version 4.5.8 or later is required. In the interim, administrators should implement strict input validation on the server side to ensure that album IDs requested correspond exclusively to resources owned by the authenticated user session. Additionally, enforcing Content Security Policy headers and restricting access to JSON endpoints based on explicit role-based permissions can help reduce the attack surface. Regular security audits focusing on object-level authorization logic are recommended to prevent similar flaws in other parts of the application architecture.