PT-2026-53662 · Librephotos · Librephotos

George Chen · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-57943

NVD

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation. Attackers can manipulate shared to relations without proper owner checks to read arbitrary private photos belonging to other users.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-57943

Affected Products

Librephotos

References · 6

• 🔥 https://github.com/LibrePhotos/librephotos/issues/1860 · Exploit
• https://github.com/LibrePhotos/librephotos/commit/325bd1f5fda71c6d56737aa09cfce0cb8106675a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-57943 · Security Note
• https://github.com/LibrePhotos/librephotos/pull/1866 · Note
• https://github.com/LibrePhotos/librephotos/releases/tag/1.0.0 · Note
• https://vulncheck.com/advisories/librephotos-insecure-direct-object-reference-in-setphotosshared-endpoint · Note