EUVD-2026-40161
GHSA-6649-8h33-mv2c
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with authenticated low-privilege access (PR:L) and enumeration requirement (AC:H); high confidentiality, low integrity, no availability impact and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation. Attackers can manipulate shared_to relations without proper owner checks to read arbitrary private photos belonging to other users.
AnalysisAI
Broken object-level authorization (BOLA/IDOR) in LibrePhotos prior to version 1.0.0 allows any authenticated user to read private photos belonging to other users by manipulating shared_to relationship parameters in the SetPhotosShared endpoint without server-side ownership validation. The attack vector is network-accessible and requires only a low-privilege account, delivering high confidentiality impact against victim photo libraries. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available as version 1.0.0.
Technical ContextAI
LibrePhotos is an open-source, self-hosted photo management platform. The vulnerable component is the SetPhotosShared API endpoint, which manages which users a photo is shared with by writing to shared_to relational records. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the server accepts user-supplied photo or user identifiers in the shared_to payload without verifying that the requesting authenticated user is the owner of the referenced photo objects. This allows an attacker to inject arbitrary photo IDs owned by other accounts into a sharing relationship, effectively granting themselves read access to those private resources. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N) confirms network delivery, low-privilege authenticated access, and high confidentiality impact confined to the vulnerable system.
RemediationAI
Upgrade to LibrePhotos version 1.0.0 or later, which resolves this authorization bypass via commit 325bd1f5fda71c6d56737aa09cfce0cb8106675a (pull request #1866 at https://github.com/LibrePhotos/librephotos/pull/1866). The patched release is available at https://github.com/LibrePhotos/librephotos/releases/tag/1.0.0. As compensating controls prior to patching, administrators should restrict instance registration to fully trusted users only, eliminating the untrusted-but-authenticated attacker scenario; note this does not remove the risk if any registered user is potentially adversarial. Placing the LibrePhotos instance behind a VPN or network access control reduces exposure to authenticated insiders and eliminates remote exploitation from the internet entirely, though it does not address insider threat. There are no known workarounds that disable the SetPhotosShared endpoint independently without broader feature impact.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today