Authorization Bypass in Blossom Product by Blossom Editor

CVE-2026-119644

What is CVE-2026-119644?

An authorization bypass vulnerability exists in Blossom through version 1.17.1, which allows authenticated non-readonly users to manipulate other users' images. By providing arbitrary picture IDs, attackers can exploit this vulnerability to delete victims' media files or alter their star status through specific endpoints, including picture deletion and batch operations. This could lead to permanent loss of valuable user data and unauthorized modifications, impacting user trust and data integrity.

References