CVE-2026-55417: Chevereto Information Disclosure Flaw

CVE-2026-55417 Overview

CVE-2026-55417 is a missing authorization vulnerability [CWE-862] in Chevereto, a self-hosted media-sharing platform. The flaw affects versions from 3.7.5 up to but not including 4.5.4. When a user enables the private profile setting, the HTML profile route /username correctly returns HTTP 404. However, the /json AJAX listing endpoint fails to enforce the same privacy check. An unauthenticated attacker who knows the target user ID can query the JSON endpoint and retrieve all publicly-scoped images along with the username that should remain private. The issue is fixed in Chevereto v4.5.4.

Critical Impact
Unauthenticated attackers can enumerate private Chevereto profiles by user ID and disclose usernames plus public image listings through the /json endpoint.

Affected Products

Chevereto versions 3.7.5 through 4.5.3
Self-hosted Chevereto media-sharing deployments with private profile enabled
Chevereto v4.5.4 contains the fix

Discovery Timeline

2026-07-07 - CVE-2026-55417 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55417

Vulnerability Analysis

CVE-2026-55417 is an authorization control inconsistency between two rendering paths of the same resource. Chevereto exposes user profiles through both an HTML route at /username and a JSON AJAX listing endpoint at /json. The HTML route enforces the private profile setting and returns HTTP 404 for restricted profiles. The JSON endpoint does not perform the equivalent visibility check before returning data.

The result is a privacy control bypass. An unauthenticated caller who knows a target's numeric user ID can request the JSON listing and receive publicly-scoped images together with the username. Since usernames are intended to remain hidden when a profile is private, this discloses identity information the owner has deliberately restricted.

Root Cause

The root cause is missing authorization [CWE-862] on the JSON listing endpoint. Access control was implemented at the HTML controller layer only, not consistently applied across all endpoints serving the same underlying resource. This is a classic parallel-endpoint enforcement gap where a secondary API path inherits the data access logic but not the policy checks of its primary counterpart.

Attack Vector

The attack requires only network access and knowledge or enumeration of a target user ID. No authentication, user interaction, or elevated privileges are required. The attacker sends a request to the /json AJAX listing endpoint referencing the target user ID. The server returns the user's public images and username despite the profile being marked private. Because user IDs are typically sequential integers, an attacker can iterate through the ID space to enumerate private accounts at scale.

No verified exploit code is publicly available. For technical details, refer to the GitHub Security Advisory GHSA-h4jp-mxfx-g8xp.

Detection Methods for CVE-2026-55417

Indicators of Compromise

Unauthenticated HTTP requests to the /json AJAX listing endpoint referencing user IDs
Sequential or scripted enumeration patterns against /json with incrementing user ID parameters
Access log entries where /json returns HTTP 200 for user IDs whose /username route returns HTTP 404
High request volume from a single source IP hitting the JSON listing endpoint

Detection Strategies

Correlate web access logs to identify sources that receive 404 responses on /username but successful responses from /json for the same user
Deploy web application firewall rules to alert on high-frequency requests to the Chevereto JSON listing endpoint from a single client
Monitor for user-agent strings and request patterns consistent with automated enumeration tools

Monitoring Recommendations

Enable verbose access logging on the Chevereto reverse proxy or web server, retaining full request URIs and response codes
Alert on request rates to /json that exceed a normal baseline for the deployment
Review logs retroactively for enumeration activity against private profiles prior to patch application

How to Mitigate CVE-2026-55417

Immediate Actions Required

Upgrade Chevereto to version 4.5.4 or later, which contains the authorization fix
Audit web server access logs for prior unauthenticated requests to the /json endpoint targeting private profiles
Notify users with private profiles that their username and public image list may have been exposed prior to patching

Patch Information

Chevereto released v4.5.4 to address CVE-2026-55417. The patch applies the private profile visibility check to the JSON AJAX listing endpoint so it returns the same 404 response as the HTML route. Details are available in the Chevereto V4.5.4 Announcement and the GitHub Security Advisory GHSA-h4jp-mxfx-g8xp.

Workarounds

No official workarounds are available from the vendor; upgrading to v4.5.4 is required
As a temporary compensating control, restrict access to the /json endpoint at the reverse proxy for unauthenticated clients
Rate-limit requests to the JSON listing endpoint to slow enumeration attempts until the patch is applied

bash

# Example nginx reverse proxy rule to rate-limit the /json endpoint
# Apply until Chevereto is upgraded to v4.5.4
limit_req_zone $binary_remote_addr zone=chv_json:10m rate=5r/m;

location ~ ^/json {
    limit_req zone=chv_json burst=5 nodelay;
    proxy_pass http://chevereto_backend;
}