Broken Object Level Authorization Vulnerability in LibrePhotos from LibrePhotos

CVE-2026-57943

What is CVE-2026-57943?

LibrePhotos prior to version 1.0.0 is affected by a vulnerability that allows authenticated users to access other users' private photos. This issue occurs in the SetPhotosShared endpoint, where users can exploit a lack of ownership validation to manipulate relationships, enabling them to read private photos that do not belong to them. The flaw results from insufficient checks over user permissions, potentially exposing sensitive data to unauthorized individuals.

References