CVE-2026-108950: Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes
Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossnalbumpagehandler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos and other stored files without any access check.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
OSSN installations through version 10.1 are affected. Any stored file reachable through the album/getphoto or album/getcover routes may be exposed, including photos marked friends-only and other stored files.
What does an attacker need to exploit it?
An attacker does not need authentication, privileges, or user interaction. They can request the affected routes and enumerate sequential file GUIDs because the handler performs no access check.
Are private or friends-only album photos protected by their visibility settings?
No. The affected routes can return friends-only album photos without verifying that the requester is authorized to access them.
How can we determine whether files may already have been exposed?
Review web or application request logs for unauthenticated requests to album/getphoto and album/getcover, particularly requests spanning sequential file GUID values. The available information does not indicate whether OSSN records successful file retrievals separately.