Authorization Bypass in Chevereto Allows Unauthenticated Access to Private Albums

CVE-2026-122326

What is CVE-2026-122326?

An authorization bypass vulnerability has been identified in Chevereto, impacting versions prior to 4.5.8. This issue resides in the 'get-album-contents' action within the /json route, which permits unauthenticated attackers to enumerate private albums simply by providing the album ID of another user. With access to a session token from any public page combined with an album's encoded ID, attackers can retrieve sensitive information, including image filenames, viewer URLs, direct file links, and even download private images without authorization. It is essential for users of Chevereto to update to version 4.5.8 or later to mitigate this risk.

References