CVE-2026-122326

MEDIUM 5.3

Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded id can obtain image filenames, viewer and direct file URLs, and download private images.

CWE	CWE-639
Vendor	chevereto
Product	chevereto
Published	Nov 5, 2026
Last Updated	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for chevereto chevereto

Be the first to know when new medium vulnerabilities affecting chevereto chevereto are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Chevereto / Chevereto

0 < 4.5.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/chevereto/chevereto/issues/136 github.com: https://github.com/chevereto/chevereto/blob/4.5.7/app/legacy/routes/json.php#L336-L410 github.com: https://github.com/chevereto/chevereto/blob/4.5.7/app/src/Legacy/Classes/Listing.php#L834-L885 github.com: https://github.com/chevereto/chevereto/commit/fe56eb789ecf5e26c84068ba7d88b7a20ea65f5c github.com: https://github.com/chevereto/chevereto/releases/tag/4.5.8 hackmd.io: https://hackmd.io/@hieund/chevereto-get-album-contents-private-album-image-disclosure github.com: https://github.com/chevereto/chevereto vulncheck.com: https://www.vulncheck.com/advisories/chevereto-before-4.5.8-private-album-image-disclosure-via-get-album-contents hackmd.io: https://hackmd.io/@hieund/cve-2026-122326-chevereto-get-album-contents-private-album-image-disclosure

Credits

hieuPenguinnn rodber