Read the docs
TI-2026-85471 Aliases CVE-2026-122326GHSA-h8vc-h7q7-f23j

Authorization bypass in Chevereto exposes private album contents

Priority HIGH 70CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Chevereto before 4.5.8 contains an authorization bypass (CWE-639) in the get-album-contents action of the /json route. An unauthenticated attacker with a session token from any public page and another user's encoded album id can list private albums, read image filenames and file URLs, and download private images.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded id can obtain image filenames, viewer and direct file URLs, and download private images.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Fix Fixed Chevereto (Chevereto): 4.5.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CheveretoCheveretobefore 4.5.84.5.8Patch availableCNA
  • Chevereto VendorChevereto Affected before 4.5.8 Fixed in 4.5.8 Patch available CNA

Remediation

Upgrade Chevereto to version 4.5.8, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Chevereto (Chevereto) Fixed in 4.5.8

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-122326
  2. 2026-11-05 Alias added: GHSA-h8vc-h7q7-f23j
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → HIGH
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 5

  • TI-2026-39986 Chevereto private profile setting leaks username on /json endpoint CVSS 4.0MEDIUM 6.9
  • TI-2021-11760 Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage. CVSS 3.1MEDIUM 6.1
  • TI-2012-02533 Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote… CVSS 2.0MEDIUM 5.0
  • TI-2017-14397 Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user… CVSS 3.0MEDIUM 6.1
  • TI-2018-08623 Chevereto Free before 1.0.13 has XSS. CVSS 3.0MEDIUM 5.4
  • TI-2012-02532 Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences