LibrePhotos/librephotos

LibrePhotos/librephotos

docs.librephotos.com

Releases7

Frequency1 year 4 months

Last Release29 days ago

Stars8K

A self-hosted open source photo management service.

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2026-57943NVD↗	—	Jun 29, 2026Monday, 29 June 2026, 18:16	5.9 MEDIUM	—
LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation. Attackers can manipulate shared_to relations without proper owner checks to read arbitrary private photos belonging to other users.
CVE-2024-53617NVD↗	—	Dec 2, 2024Monday, 2 December 2024, 19:15	4.8 MEDIUM	—
A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file on behalf of the admin user using IDOR in file upload.
CVE-2023-22903NVD↗	< 2023-01-09	Jan 10, 2023Tuesday, 10 January 2023, 06:15	9.8 CRITICAL	—
api/views/user.py in LibrePhotos before e19e539 has incorrect access control.