PT-2026-133574
CVE-2026-119644
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
Found an issue in the description? Have something to add? Feel free to write us 👾