Tbed CVE-2026-111674

Requires a valid authenticated account of any privilege level on the target Tbed instance (PR:L) and network reach to the /admin/setImgFileName endpoint. The attacker must also know the victim's imgname identifier - but this is not a meaningful barrier because imgname is exposed in public image URLs and album listings. No special or non-default configuration is needed, and no user interaction by the victim is required. Exploitation is limited to the integrity of image display-name metadata (impersonation/defacement); it does not expose or exfiltrate data and does not affect availability. The only real limiting factor is the need for an authenticated account on the application.

This is a medium-severity, integrity-only issue that does not warrant emergency prioritization. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity flaw, but it explicitly requires an authenticated account (PR:L) and yields only limited integrity impact (VI:L) with no confidentiality (VC:N) or availability (VA:N) consequences - consistent with a CWE-639 IDOR that merely lets a logged-in user overwrite another user's image display names. No CISA KEV listing and no EPSS score are present in the input, so there is no signal of active or probable widespread exploitation; a public technical write-up (hackmd) and source-code line references exist, which lowers the barrier to reproduction, but that is reproduction detail, not evidence of exploitation in the wild. The signals are internally consistent (network-reachable but authentication-gated, low impact), so there is no contradiction to resolve. Net: a real but low-priority defacement/impersonation bug in a niche self-hosted product - patch in normal cycles rather than as an incident.

An attacker registers or already holds any low-privileged account on a Tbed instance, harvests a target user's imgname from a public image URL or album listing, then calls /admin/setImgFileName with the victim's imgname and an attacker-chosen string. The victim's image display name is overwritten with attacker-controlled text still attributed to the victim, enabling impersonation, abusive content, or defacement. A detailed public write-up documents the flaw and the exact vulnerable code, easing reproduction.