Read the docs
TI-2026-39986 Aliases CVE-2026-55417

Chevereto private profile setting leaks username on /json endpoint

Priority HIGH 70CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private). This is patched in Chevereto v4.5.4. No known workarounds are available.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00421 36th percentileScored 2026-11-07
Fix Fixed chevereto (chevereto): 4.5.4chevereto/chevereto (chevereto): 4.5.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cheveretochevereto3.7.5 to before 4.5.44.5.4Patch availableCNA
Cheveretochevereto/chevereto4.0.5 to before 4.5.44.5.4Patch availableCNA
Cheveretorodber/chevereto-free>= 1.0.0—No fix listedCNA
  • chevereto VendorChevereto Affected 3.7.5 to before 4.5.4 Fixed in 4.5.4 Patch available CNA
  • chevereto/chevereto VendorChevereto Affected 4.0.5 to before 4.5.4 Fixed in 4.5.4 Patch available CNA
  • rodber/chevereto-free VendorChevereto Affected >= 1.0.0 Fixed in — No fix listed CNA

Remediation

  • Fix · CNA chevereto (chevereto) Fixed in 4.5.4
  • Fix · CNA chevereto/chevereto (chevereto) Fixed in 4.5.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55417

References

Other 2

  • TI-2026-85471 Authorization bypass in Chevereto exposes private album contents CVSS 4.0MEDIUM 6.9
  • TI-2021-11760 Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage. CVSS 3.1MEDIUM 6.1
  • TI-2012-02533 Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote… CVSS 2.0MEDIUM 5.0
  • TI-2017-14397 Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user… CVSS 3.0MEDIUM 6.1
  • TI-2018-08623 Chevereto Free before 1.0.13 has XSS. CVSS 3.0MEDIUM 5.4
  • TI-2012-02532 Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences