PT-2026-53662 · Librephotos · Librephotos

George Chen · Publicado 2026-06-29 · Atualizado 2026-06-29 · CVE-2026-57943

NVD

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation. Attackers can manipulate shared to relations without proper owner checks to read arbitrary private photos belonging to other users.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-57943

Produtos afetados

Librephotos

Referências · 6

• 🔥 https://github.com/LibrePhotos/librephotos/issues/1860 · Exploit
• https://github.com/LibrePhotos/librephotos/pull/1866 · Nota
• https://github.com/LibrePhotos/librephotos/commit/325bd1f5fda71c6d56737aa09cfce0cb8106675a · Correção
• https://github.com/LibrePhotos/librephotos/releases/tag/1.0.0 · Nota
• https://vulncheck.com/advisories/librephotos-insecure-direct-object-reference-in-setphotosshared-endpoint · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57943 · Nota de Segurança