CVE-2026-57943 Details
Description
LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation. Attackers can manipulate shared_to relations without proper owner checks to read arbitrary private photos belonging to other users.
A broken object level authorization vulnerability has been identified in LibrePhotos versions prior to 1.0.0. This vulnerability allows authenticated users to bypass ownership validation in the SetPhotosShared endpoint, enabling them to grant themselves access to other users' private photos. Attackers can manipulate the shared_to relations without proper owner checks, effectively reading arbitrary private photos belonging to others.
The vulnerability has been addressed in LibrePhotos version 1.0.0. Users should update to this version to mitigate the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LibrePhotos/librephotos/issues/1860 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/LibrePhotos/librephotos/commit/325bd1f5fda71c6d56737aa09cfce0cb8106675a | [email protected] | Source CodeVendor |
| https://github.com/LibrePhotos/librephotos/issues/1860 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/LibrePhotos/librephotos/pull/1866 | [email protected] | Issue TrackingVendor |
| https://github.com/LibrePhotos/librephotos/releases/tag/1.0.0 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/librephotos-insecure-direct-object-reference-in-setphotosshared-endpoint | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LibrePhotos | < 1.0.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | [email protected] |