Description
LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation. Attackers can manipulate shared_to relations without proper owner checks to read arbitrary private photos belonging to other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LibrePhotos | librephotos | < 1.0.0 | 1.0.0 |
References
- librephotos 1.0.0 Release Notes release-notes
- Researcher Disclosure issue-tracking
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/librephotos-insecure-direct-object-reference-in-setphotosshared-endpoint third-party-advisory