Tbed
Monthly
Tbed instances through the 20240319 snapshot let any authenticated user rename another user's images by submitting the victim's imgname to the /admin/setImgFileName endpoint, a missing-authorization (CWE-639) flaw that undermines integrity but not confidentiality or availability. Because imgname values are exposed in public image URLs and album listings, the attacker needs no privileged knowledge to target a victim, and the write allows attacker-chosen display text to be attributed to that victim's images (impersonation/defacement). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (scored 5.3 in the source data), requiring a valid low-privilege account but no victim interaction; no public exploit identified at time of analysis.
Tbed instances through the 20240319 snapshot let any authenticated user rename another user's images by submitting the victim's imgname to the /admin/setImgFileName endpoint, a missing-authorization (CWE-639) flaw that undermines integrity but not confidentiality or availability. Because imgname values are exposed in public image URLs and album listings, the attacker needs no privileged knowledge to target a victim, and the write allows attacker-chosen display text to be attributed to that victim's images (impersonation/defacement). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (scored 5.3 in the source data), requiring a valid low-privilege account but no victim interaction; no public exploit identified at time of analysis.