https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 01:17:19 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-122326 <p>Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user&#39;s album id. Attackers with a session token from any public page and an album&#39;s encoded id can obtain image filenames, viewer and direct file URLs, and download private images.</p> <p>Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user&#39;s album id. Attackers with a session token from any public page and an album&#39;s encoded id can obtain image filenames, viewer and direct file URLs, and download private images.</p> https://db.gcve.eu/vuln/fkie_cve-2026-122326 https://db.gcve.eu/vuln/ghsa-h8vc-h7q7-f23j <p>Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user&#39;s album id. Attackers with a session token from any public page and an album&#39;s encoded id can obtain image filenames, viewer and direct file URLs, and download private images.</p> <p>Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user&#39;s album id. Attackers with a session token from any public page and an album&#39;s encoded id can obtain image filenames, viewer and direct file URLs, and download private images.</p> https://db.gcve.eu/vuln/ghsa-h8vc-h7q7-f23j