Bug 2567645 (CVE-2026-122326) - CVE-2026-122326 chevereto: Chevereto: Information disclosure via authorization bypass in album contents endpoint
Summary: CVE-2026-122326 chevereto: Chevereto: Information disclosure via authorizatio...
Keywords:
Status: NEW
Alias: CVE-2026-122326
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-05 22:14 UTC by OSIDB Bzimport
Modified: 2026-11-06 00:03 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-05 22:14:33 UTC 
Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded id can obtain image filenames, viewer and direct file URLs, and download private images.
Note You need to log in before you can comment on or make changes to this bug.