Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-122326Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in Chevereto from Chevereto. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 55.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded id can obtain image filenames, viewer and direct file URLs, and download private images.

Affected products (as reported)

Vendor	Product	Versions
Chevereto	Chevereto	0 – before 4.5.8

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/chevereto/chevereto/issues/136 issue-tracking
https://github.com/chevereto/chevereto/blob/4.5.7/app/legacy/routes/json.php#L336-L410 technical-description
https://github.com/chevereto/chevereto/blob/4.5.7/app/src/Legacy/Classes/Listing.php#L834-L885 technical-description
https://github.com/chevereto/chevereto/commit/fe56eb789ecf5e26c84068ba7d88b7a20ea65f5c patch
Chevereto 4.5.8 Release Notes release-notes
https://hackmd.io/@hieund/chevereto-get-album-contents-private-album-image-disclosure third-party-advisory
https://github.com/chevereto/chevereto product
VulnCheck Advisory: Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents third-party-advisory
https://hackmd.io/@hieund/cve-2026-122326-chevereto-get-album-contents-private-album-image-disclosure exploit