Security Advisory

CVE-2026-57943

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-29 17:17:32

Last updated 2026-07-14 21:34:36

Assigner VulnCheck

CVSS score 6.0

State PUBLISHED

Description

LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation. Attackers can manipulate shared_to relations without proper owner checks to read arbitrary private photos belonging to other users.

← Browse all CVEs View on cve.org ↗