Museum Server
Monthly
Account takeover in Ente Museum Server versions through 2.0.34 is achievable by an authenticated user designated as a victim's emergency contact, bypassing the configured recovery waiting period via a crafted `approve-recovery` API request. The vulnerability requires a pre-established trust relationship - the attacker must already be configured as the victim's emergency contact - which limits opportunistic mass exploitation, consistent with the low EPSS score of 0.17%. Security researcher VokeCyber has published a public technical writeup and blog post detailing the attack; no confirmed active exploitation or KEV listing exists at time of analysis.
Account takeover in Ente Museum Server versions through 2.0.34 is achievable by an authenticated user designated as a victim's emergency contact, bypassing the configured recovery waiting period via a crafted `approve-recovery` API request. The vulnerability requires a pre-established trust relationship - the attacker must already be configured as the victim's emergency contact - which limits opportunistic mass exploitation, consistent with the low EPSS score of 0.17%. Security researcher VokeCyber has published a public technical writeup and blog post detailing the attack; no confirmed active exploitation or KEV listing exists at time of analysis.