CVE-2026-55417 Details
Description
Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private). This is patched in Chevereto v4.5.4. No known workarounds are available.
A vulnerability in Chevereto, a self-hosted media-sharing platform, allows for the leakage of usernames and publicly-scoped image data from users with private profiles. This issue affects Chevereto versions 3.7.5 prior to 4.5.4. When a private profile is enabled, the user's profile HTML route correctly returns a 404 error. However, the '/json' AJAX listing endpoint fails to apply the same privacy check. An unauthenticated user who knows the target's user ID can access all of that user's publicly-scoped images, along with the username, which should remain private.
Users can update to Chevereto version 4.5.4 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chevereto/chevereto/security/advisories/GHSA-h4jp-mxfx-g8xp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://chevereto.com/community/threads/chevereto-v4-5-4-announcement.16398/post-80153 | [email protected] | Content WallVendor |
| https://github.com/chevereto/chevereto/security/advisories/GHSA-h4jp-mxfx-g8xp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chevereto | >= 3.7.5, < 4.5.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |