Vulnerability Description
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/blossom-editor/blossom
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/s
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/s
- https://github.com/blossom-editor/blossom/issues/214
- https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete
- https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass
FAQ
What is CVE-2026-119644?
CVE-2026-119644 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can cal...
How severe is CVE-2026-119644?
CVE-2026-119644 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119644?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.