CVE-2026-119644
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
Risk Assessment
An authenticated user can permanently delete or modify other users' resources, causing data loss and service disruption.
Recommendation
Upgrade Blossom beyond 1.17.1; until then, restrict access to the /picture/del, /picture/del/batch and /picture/star endpoints and verify resource ownership checks.
Other vulnerabilities in Blossom
Original NVD description (English source)
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS