CVE-2026-119644: Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints

Published Oct 30, 2026

Updated

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.

Event History

Oct 30, 2026

CVE Published

via MITRE·02:16 PM

Data Sourced

via MITRE·02:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated user whose account is not read-only can exploit the affected picture endpoints. No additional interaction from the victim is required.

What actions can an attacker perform?

An attacker can supply arbitrary picture IDs to the picture delete, batch delete, or star endpoints. This can permanently delete another user's images and stored files or change the star status of those pictures.

How can I determine whether my deployment is affected?

Deployments running Blossom through 1.17.1 are affected if non-read-only users can access the picture delete, /picture/del/batch, or /picture/star endpoints. Review whether requests to these endpoints validate that the requested picture belongs to the authenticated user.

CVE-2026-119644: Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints

Event History

Frequently Asked Questions

Which users can exploit this issue?

What actions can an attacker perform?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What actions can an attacker perform?

How can I determine whether my deployment is affected?