CVE-2026-55417

MediumCVSS 6.9

Published: 07/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

In Chevereto before version 4.5.4, enabling the private profile option does not block access to the user's image list via the `/json` endpoint. An unauthenticated attacker who knows the victim's ID can retrieve all public images and reveal the username.

Risk Assessment

The risk is the exposure of private user data (username and images) to unauthorized parties, compromising confidentiality and potentially enabling further social engineering attacks.

Recommendation

Immediately upgrade Chevereto to version 4.5.4 or later, which contains the fix for this vulnerability.

Other vulnerabilities in Chevereto

CVE-2021-31721Medium
An XSS vulnerability in Chevereto before version 3.17.1 allows an attacker to inject malicious script via the image title during file upload.

Original NVD description (English source)

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private). This is patched in Chevereto v4.5.4. No known workarounds are available.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS