EUVD-2026-50323
GHSA-jmh3-fv99-c329
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Emergency contact role requires authenticated API access over the network (AV:N, PR:L); C:N reflects Ente's client-side E2E encryption limiting server-side data exposure.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted approve-recovery API request.
AnalysisAI
Account takeover in Ente Museum Server versions through 2.0.34 is achievable by an authenticated user designated as a victim's emergency contact, bypassing the configured recovery waiting period via a crafted approve-recovery API request. The vulnerability requires a pre-established trust relationship - the attacker must already be configured as the victim's emergency contact - which limits opportunistic mass exploitation, consistent with the low EPSS score of 0.17%. Security researcher VokeCyber has published a public technical writeup and blog post detailing the attack; no confirmed active exploitation or KEV listing exists at time of analysis.
Technical ContextAI
Ente Museum Server is the open-source, self-hosted backend for the Ente privacy-focused photo storage platform (CPE: cpe:2.3:a:ente:museum_server:*:*:*:*:*:*:*:*). The platform implements an emergency recovery feature allowing account owners to designate trusted contacts who can help regain account access after a configurable waiting period - a deliberate delay designed to alert the legitimate owner and prevent unauthorized takeovers. The flaw resides in the approve-recovery API endpoint, which fails to enforce the temporal waiting-period gate before processing an approval. Although tagged 'Authentication Bypass' by reporters, this is more precisely an authorization bypass: the attacker is legitimately authenticated and holds a valid emergency contact role, but the application fails to enforce a mandatory time-based access control constraint (CWE not formally assigned). Ente uses client-side end-to-end encryption, meaning server-side account takeover may not directly expose plaintext photo data, which informs the CVSS C:N rating.
RemediationAI
Verify the Ente Museum Server changelog at https://github.com/ente/ente to determine whether v2.0.34 is the patched release or the last vulnerable release, and upgrade to any confirmed version above v2.0.34. The VokeCyber advisory at https://vokecyber.com/research/cve-2026-16751-ente-emergency-recovery-bypass provides additional remediation context. Where immediate patching is not feasible, administrators should audit and remove untrusted emergency contact designations from all user accounts, since exploitation is gated entirely on that pre-existing trust relationship. Additionally, monitor Museum Server API logs for anomalous approve-recovery requests - particularly those occurring before a recovery waiting period has elapsed - as an intrusion detection measure. Restricting network-level access to the Museum Server API to trusted networks reduces exposure for self-hosted deployments.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today