Skip to content
OpenAdvisories

Vendor

Chevereto

2 known vulnerabilities.

Products

Chevereto 2 chevereto/chevereto 1 rodber/chevereto-free 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-122326

    Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents

    Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from an…

    Chevereto Chevereto
  • Medium 6.9
    CVE-2026-55417

    Chevereto private profile setting leaks username on /json endpoint

    Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing e…

    Chevereto Chevereto chevereto/chevereto rodber/chevereto-free