CVE-2026-122326: Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents
Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded id can obtain image filenames, viewer and direct file URLs, and download private images.
Event History
Frequently Asked Questions
What does an attacker need to access private album images?
The attacker needs a session token obtainable from any public page and the encoded ID of the target album. No authenticated account or user interaction is required.
What information and access can be obtained through the vulnerable action?
An attacker can enumerate a private album's image filenames, viewer URLs, and direct file URLs. The direct URLs can then be used to download the private images.
Which deployments are affected?
Chevereto versions before 4.5.8 are affected. Deployments that host private albums are exposed if an attacker can obtain an album's encoded ID and a session token from a public page.