Skip to main content

Chevereto CVE-2026-55417

| EUVDEUVD-2026-42085 MEDIUM
Missing Authorization (CWE-862)
2026-07-07 GitHub_M
Authentication Bypass Chevereto Chevereto Chevereto Rodber Chevereto Free
6.9
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable unauthenticated endpoint (AV:N/PR:N) with low confidentiality impact confined to username and public-scoped images; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 07, 2026 - 22:01 EUVD
Analysis Generated
Jul 07, 2026 - 20:59 vuln.today

DescriptionCVE.org

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (/username) correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private). This is patched in Chevereto v4.5.4. No known workarounds are available.

AnalysisAI

Chevereto's /json AJAX listing endpoint fails to enforce the private profile access control that the HTML profile route correctly applies, exposing user images and usernames to unauthenticated callers. Versions 3.7.5 through 4.5.3 are affected across both the commercial Chevereto product and the Chevereto Free (rodber/chevereto-free) variant. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify target Chevereto instance
Delivery
Enumerate numeric user IDs sequentially via HTTP
Exploit
Confirm private profile via HTML route returning 404
Execution
Query /json AJAX endpoint directly with known user ID
Impact
Extract publicly-scoped image list and username from API response
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two conditions: (1) the target user must have enabled the private profile option in their Chevereto account settings - users who have not opted into this feature are unaffected, and (2) the attacker must know or successfully enumerate the target's numeric user ID, since the private HTML profile route suppresses the username entirely. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 6.9) indicates a network-accessible, unauthenticated, zero-complexity attack path, but the blast radius is bounded: impact is constrained to low confidentiality on the vulnerable system (VC:L) with no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker identifies a Chevereto instance and iterates through sequential numeric user IDs, confirming that the HTML profile route (`/alice`) returns 404 (indicating a private profile), then directly queries the `/json` endpoint with the known user ID to receive a full JSON response containing the user's publicly-scoped image metadata and their username. The entire operation requires only a standard HTTP client and no authentication or elevated access. …
Remediation Upgrade to Chevereto v4.5.4, which patches the missing authorization check on the `/json` AJAX listing endpoint to match the access control already applied to the HTML profile route, as confirmed by the GitHub Security Advisory GHSA-h4jp-mxfx-g8xp and the vendor announcement at https://chevereto.com/community/threads/chevereto-v4-5-4-announcement.16398/post-80153. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Chevereto

View all
CVE-2021-31721 MEDIUM POC
6.1 Jun 30

Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage. Rated medium sev
CVE-2012-2919 MEDIUM POC
5.0 May 21

Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote attackers to determine the exist
CVE-2018-12030 MEDIUM POC
5.4 Jun 15

Chevereto Free before 1.0.13 has XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low

CVE-2012-2918 MEDIUM POC
4.3 May 21

Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbitr
CVE-2017-1000058 MEDIUM
6.1 Jul 17

Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data pars

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2025-20362 MEDIUM POC
6.5
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-55417 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy