OSSN CVE-2026-108950

No special conditions beyond network reachability - the flaw is a missing access check in ossn_album_page_handler for the album/getphoto and album/getcover routes, exploitable by unauthenticated attackers against default OSSN installations through version 10.1 (CWE-862). The only real prerequisites are: (1) the attacker can reach the OSSN web instance over the network, and (2) the attacker enumerates sequential, guessable file GUIDs to locate target files. Limiting factors are minimal: no authentication, no user interaction, and no non-default configuration are required, though impact is confined to reading stored photos/files (confidentiality), not modification or service disruption.

This is a genuine but moderate-priority information-disclosure issue rather than a critical system-compromise flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, which is why the base score lands at 6.9 (Medium). Crucially, impact is limited to confidentiality only (VC:L, with VI:N/VA:N and no subsequent-system impact SC:N/SI:N/SA:N) - an attacker reads stored album photos and files but cannot modify data or affect availability. A public exploit exists (publicly available exploit code exists), which raises practical likelihood, but the vulnerability is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - treat the POC as a capability signal, not confirmation of in-the-wild attacks. The sequential-GUID enumeration design makes mass scraping of a given instance trivial once an attacker finds it, but the overall priority is tempered by the Low confidentiality impact and the niche deployment footprint of OSSN. Reporting is attributed to VulnCheck with a vendor patch available. Missing signals: no EPSS and no KEV data were supplied - their absence is expected for a recently published CVE and should not be read as low risk by itself.

An unauthenticated attacker sends crafted requests to album/getphoto and album/getcover and iterates sequential file GUIDs, retrieving friends-only album photos and other stored files that should be access-restricted, with no login required. Because public exploit code is already available (per the referenced hackmd write-up) and complexity is low, an attacker can script bulk enumeration to scrape an entire instance's private media. The practical limit is that the attacker must be able to reach the OSSN instance over the network and must iterate GUIDs to discover valid files.