Is there a patch available for CVE-2026-55417?

Yes, a patch is available for CVE-2026-55417. Update the affected software to the latest version immediately.

Chevereto CVE-2026-55417

Q: What is the CVSS score of CVE-2026-55417?

CVE-2026-55417 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

Q: Which versions of Chevereto are affected by CVE-2026-55417?

Chevereto's `/json` AJAX listing endpoint fails to enforce the private profile access control that the HTML profile route correctly applies, exposing user images and usernames to unauthenticated…. A patch is available.

EUVD-2026-42085 MEDIUM

Missing Authorization (CWE-862)

2026-07-07 GitHub_M

Authentication Bypass Chevereto Chevereto Chevereto Rodber Chevereto Free

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint (AV:N/PR:N) with low confidentiality impact confined to username and public-scoped images; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 20:59 vuln.today

DescriptionCVE.org

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (/username) correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private). This is patched in Chevereto v4.5.4. No known workarounds are available.

AnalysisAI

Chevereto's /json AJAX listing endpoint fails to enforce the private profile access control that the HTML profile route correctly applies, exposing user images and usernames to unauthenticated callers. Versions 3.7.5 through 4.5.3 are affected across both the commercial Chevereto product and the Chevereto Free (rodber/chevereto-free) variant. An unauthenticated attacker who knows a target's numeric user ID can bypass the privacy setting to retrieve all publicly-scoped media and recover the username the victim explicitly chose to hide. No public exploit is identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Technical ContextAI

Chevereto is a PHP-based, self-hosted image and media hosting platform (CPE: cpe:2.3:a:chevereto:chevereto). The flaw is rooted in CWE-862 (Missing Authorization) - the application correctly enforces access control on the HTML profile route (/username, returning 404 for private profiles) but neglects to apply equivalent authorization logic to the /json AJAX listing endpoint used by the frontend to retrieve image galleries. This inconsistency between the presentation layer and the data API layer is a classic broken object-level authorization pattern: the UI enforces the privacy constraint, but the underlying data endpoint does not, leaving it directly queryable. Both the commercial edition and the free community fork (cpe:2.3:a:chevereto:rodber/chevereto-free) are affected per CPE data, and the vulnerability was introduced in v3.7.5 when the private profile feature was added.

RemediationAI

Upgrade to Chevereto v4.5.4, which patches the missing authorization check on the /json AJAX listing endpoint to match the access control already applied to the HTML profile route, as confirmed by the GitHub Security Advisory GHSA-h4jp-mxfx-g8xp and the vendor announcement at https://chevereto.com/community/threads/chevereto-v4-5-4-announcement.16398/post-80153. The vendor states no known workarounds are available. Operators who cannot immediately upgrade may consider adding a web server-level rule (nginx location block or Apache RewriteRule) to deny or authenticate requests matching the pattern /<username>/json for all users, though this will also break legitimate AJAX gallery loading for all visitors - a significant UX trade-off. Rate-limiting enumeration of user ID parameters at the WAF layer can reduce the risk of bulk scraping but does not eliminate the underlying authorization gap.