Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Blossom by blossom-editor
CVE-2026-119659 (GCVE-0-2026-119659)
Vulnerability from nvd – Published: 2026-10-30 14:16 – Updated: 2026-10-30 14:16
VLAI
EPSS
VEX
Title
Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
Summary
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.
Severity
5.4 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/blossom-editor/blossom/issues/213 | issue-tracking |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://hackmd.io/@hieuPenguinnn/blossom-folder-i… | third-party-advisory |
| https://github.com/blossom-editor/blossom | product |
| https://www.vulncheck.com/advisories/blossom-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blossom-editor | Blossom |
Affected:
0 , ≤ 1.17.1
(semver)
cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/blossom-editor/blossom",
"product": "Blossom",
"repo": "https://github.com/blossom-editor/blossom",
"vendor": "blossom-editor",
"versions": [
{
"lessThanOrEqual": "1.17.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users\u0027 folders because FolderService queries filter only on folder id. Attackers can supply another user\u0027s folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:20.531Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/blossom-editor/blossom/issues/213"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/folder/FolderService.java#L123-L202"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/resources/mapper/FolderMapper.xml#L64-L92"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/blossom-folder-idor-cross-user-modify-delete"
},
{
"tags": [
"product"
],
"url": "https://github.com/blossom-editor/blossom"
},
{
"name": "VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Folder Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-folder-endpoints"
}
],
"title": "Blossom through 1.17.1 Authorization Bypass via Folder Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119659",
"datePublished": "2026-10-30T14:16:20.531Z",
"dateReserved": "2026-10-30T13:43:48.691Z",
"dateUpdated": "2026-10-30T14:16:20.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119644 (GCVE-0-2026-119644)
Vulnerability from nvd – Published: 2026-10-30 14:16 – Updated: 2026-10-30 14:16
VLAI
EPSS
VEX
Title
Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints
Summary
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
Severity
5.4 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/blossom-editor/blossom/issues/214 | issue-tracking |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://hackmd.io/@hieuPenguinnn/blossom-picture-… | third-party-advisory |
| https://github.com/blossom-editor/blossom | product |
| https://www.vulncheck.com/advisories/blossom-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blossom-editor | Blossom |
Affected:
0 , ≤ 1.17.1
(semver)
cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/blossom-editor/blossom",
"product": "Blossom",
"repo": "https://github.com/blossom-editor/blossom",
"vendor": "blossom-editor",
"versions": [
{
"lessThanOrEqual": "1.17.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users\u0027 pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims\u0027 images and stored files or change their star status."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:08.905Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/blossom-editor/blossom/issues/214"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureService.java#L222-L232"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureController.java#L56-L109"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete"
},
{
"tags": [
"product"
],
"url": "https://github.com/blossom-editor/blossom"
},
{
"name": "VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-picture-delete-and-star-endpoints"
}
],
"title": "Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119644",
"datePublished": "2026-10-30T14:16:08.905Z",
"dateReserved": "2026-10-30T13:43:32.954Z",
"dateUpdated": "2026-10-30T14:16:08.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119659 (GCVE-0-2026-119659)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 14:16
VLAI
EPSS
VEX
Title
Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
Summary
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.
Severity
5.4 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/blossom-editor/blossom/issues/213 | issue-tracking |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://hackmd.io/@hieuPenguinnn/blossom-folder-i… | third-party-advisory |
| https://github.com/blossom-editor/blossom | product |
| https://www.vulncheck.com/advisories/blossom-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blossom-editor | Blossom |
Affected:
0 , ≤ 1.17.1
(semver)
cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/blossom-editor/blossom",
"product": "Blossom",
"repo": "https://github.com/blossom-editor/blossom",
"vendor": "blossom-editor",
"versions": [
{
"lessThanOrEqual": "1.17.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users\u0027 folders because FolderService queries filter only on folder id. Attackers can supply another user\u0027s folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:20.531Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/blossom-editor/blossom/issues/213"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/folder/FolderService.java#L123-L202"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/resources/mapper/FolderMapper.xml#L64-L92"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/blossom-folder-idor-cross-user-modify-delete"
},
{
"tags": [
"product"
],
"url": "https://github.com/blossom-editor/blossom"
},
{
"name": "VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Folder Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-folder-endpoints"
}
],
"title": "Blossom through 1.17.1 Authorization Bypass via Folder Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119659",
"datePublished": "2026-10-30T14:16:20.531Z",
"dateReserved": "2026-10-30T13:43:48.691Z",
"dateUpdated": "2026-10-30T14:16:20.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119644 (GCVE-0-2026-119644)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 14:16
VLAI
EPSS
VEX
Title
Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints
Summary
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
Severity
5.4 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/blossom-editor/blossom/issues/214 | issue-tracking |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://hackmd.io/@hieuPenguinnn/blossom-picture-… | third-party-advisory |
| https://github.com/blossom-editor/blossom | product |
| https://www.vulncheck.com/advisories/blossom-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blossom-editor | Blossom |
Affected:
0 , ≤ 1.17.1
(semver)
cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/blossom-editor/blossom",
"product": "Blossom",
"repo": "https://github.com/blossom-editor/blossom",
"vendor": "blossom-editor",
"versions": [
{
"lessThanOrEqual": "1.17.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users\u0027 pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims\u0027 images and stored files or change their star status."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:08.905Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/blossom-editor/blossom/issues/214"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureService.java#L222-L232"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureController.java#L56-L109"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete"
},
{
"tags": [
"product"
],
"url": "https://github.com/blossom-editor/blossom"
},
{
"name": "VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-picture-delete-and-star-endpoints"
}
],
"title": "Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119644",
"datePublished": "2026-10-30T14:16:08.905Z",
"dateReserved": "2026-10-30T13:43:32.954Z",
"dateUpdated": "2026-10-30T14:16:08.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}