Photoprism
Monthly
PhotoPrism's AlbumCover handler through commit bb0b933 exposes an insecure direct object reference that permits any user holding a valid preview token to retrieve original-resolution cover images from albums owned by other users. The handler omits ownership verification entirely, making album ID enumeration sufficient to cross user trust boundaries. No public exploit code has been identified at time of analysis, but the low attack complexity makes this straightforward to abuse in any multi-user PhotoPrism deployment.
PhotoPrism's AlbumCover handler through commit bb0b933 exposes an insecure direct object reference that permits any user holding a valid preview token to retrieve original-resolution cover images from albums owned by other users. The handler omits ownership verification entirely, making album ID enumeration sufficient to cross user trust boundaries. No public exploit code has been identified at time of analysis, but the low attack complexity makes this straightforward to abuse in any multi-user PhotoPrism deployment.