CVE-2026-16751

MEDIUM 6.5

Ente Museum Server Authorization Bypass Vulnerability

CVSS Score

6.5

EPSS Score

0.3%

EPSS Percentile

22th

Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted `approve-recovery` API request.

Vendor	ente
Product	museum server
Published	Jul 29, 2026
Last Updated	Sep 23, 2026

Stay Ahead of the Next One

Get instant alerts for ente museum server

Be the first to know when new medium vulnerabilities affecting ente museum server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Ente / Museum Server

0 ≤ 2.0.34

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ente/ente/tree/v2.0.34 vokecyber.com: https://vokecyber.com/research/cve-2026-16751-ente-emergency-recovery-bypass vokecyber.com: https://vokecyber.com/blog/cve-2026-16751-ente-emergency-recovery-bypass github.com: https://github.com/ente/ente/commit/4789ae67368c1f9ba7eb1a0e2c0588e4a9a55746