Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104875— Ente: Accepted emergency contact can bypass the recovery notice period

Quick assessment

Affected
ente ente
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ente 提供端到端加密的云服务和安全工具。在服务器镜像版本 2026.07.09 之前， 端点使用客户端提供的用户 ID（userID）来授权紧急联系人恢复请求，并仅通过客户端提供的恢复会话 UUID（recovery-session UUID）更新紧急恢复会话。已接受的紧急联系人可以提交自己的标识符，将受害者的会话状态从“WAITING”（等待中）转变为“READY”（已就绪），清除等待时间（wait_till），检索恢复信息，并在所有者配置的通知期到期前继续完成账户恢复流程。 利用此批准绕过漏洞的前提条件是：

CVSS 7.1 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
ente ente < 0.1.18 affected
ente ghcr.io/ente/server < 2026.07.09 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104875

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ente: Accepted emergency contact can bypass the recovery notice period
Source: CVE Program / CVE List V5
Vulnerability Description
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ente ente < 0.1.18 -
ente ghcr.io/ente/server < 2026.07.09 -

II. Public POCs for CVE-2026-104875

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104875

请登录查看更多情报信息。

Other References for CVE-2026-104875 (5)

IV. Related Vulnerabilities

Same product: ente
Same vendor: ente
Same weakness: CWE-639

V. Comments for CVE-2026-104875

No comments yet

Leave a comment