CVE-2026-111674 Details

A missing authorization vulnerability has been identified in Tbed, an image-hosting service, in versions through 20240319. This vulnerability allows any authenticated user to rename images belonging to other users via the '/admin/setImgFileName' endpoint. The issue arises because the endpoint lacks proper ownership checks, enabling attackers to overwrite image metadata with their own text, which is then attributed to the original image owner. The vulnerability is exploitable by any user with a valid token, including newly registered accounts, and requires knowledge of the victim's image name, which is publicly accessible through image URLs and album listings.

The vulnerability can be addressed by implementing ownership checks in the 'setImgFileName' handler, ensuring that only image owners or administrators can modify image metadata. Additionally, the application could restrict certain metadata fields, like violation flags, to admin users only.