Ente prior 2026.07.09 Emergency Contact Approval approve-recovery userID/recovery-session UUID improper authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in Ente. This affects an unknown function of the file /emergency-contacts/approve-recovery of the component Emergency Contact Approval. Performing a manipulation of the argument userID/recovery-session UUID results in improper authorization. This vulnerability is identified as CVE-2026-104875. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Ente. This affects an unknown functionality of the file /emergency-contacts/approve-recovery of the component Emergency Contact Approval. The manipulation of the argument userID/recovery-session UUID with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-104875 since 10/02/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 2026.07.09 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Ente

Website

• Product: https://github.com/ente/ente/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion