Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119644Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in Blossom from blossom-editor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 74.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.

Affected products (as reported)

Vendor	Product	Versions
blossom-editor	Blossom	0 – through 1.17.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/blossom-editor/blossom/issues/214 issue-tracking
https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureService.java#L222-L232 technical-description
https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureController.java#L56-L109 technical-description
https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete third-party-advisory
https://github.com/blossom-editor/blossom product
VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints third-party-advisory