CVE-2026-55417 | Chevereto is a self-hosted media-sharing platform. Starting … | CVSS 6.9 MEDIUM

Description

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private). This is patched in Chevereto v4.5.4. No known workarounds are available.

Metadata

CVE ID: CVE-2026-55417
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-16 21:48 UTC
Published: 2026-07-07 20:02 UTC
Last updated: 2026-07-07 20:03 UTC
Primary CWE: CWE-862
CWE-862: Missing Authorization
Vendor / Product: chevereto / chevereto
Sources: cve.org · NVD

Severity & Metrics

6.9 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products (3)

Vendor	Product	Platform	Versions
chevereto	chevereto	—	>= 3.7.5, < 4.5.4
chevereto	chevereto/chevereto	—	>= 4.0.5, < 4.5.4
chevereto	rodber/chevereto-free	—	>= 1.0.0

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862: Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.9	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References (2)

https://github.com/chevereto/chevereto/security/advisories/GHSA-h4jp-mxfx-g8xp https://github.com/chevereto/chevereto/security/advisories/GHSA-h4jp-mxfx-g8xp
https://chevereto.com/community/threads/chevereto-v4-5-4-announcement.16398/post-80153 https://chevereto.com/community/threads/chevereto-v4-5-4-announcement.16398/post-80153