Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55417— Chevereto private profile setting leaks username on /json endpoint

Quick assessment

Affected
chevereto chevereto
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Chevereto是Chevereto公司开源的一个图床程序。 Chevereto存在授权问题漏洞，该漏洞源于当用户启用私人资料选项时， AJAX列表端点未应用权限检查，导致未经验证的调用者知道目标用户ID即可检索该用户的所有公开范围图像并泄露用户名。以下版本受到影响：3.7.5版本至4.5.4之前版本、4.0.5版本至4.5.4之前版本。

AI Predicted 5.3 Difficulty: Trivial EPSS 0.42% · P35

Affected Version Matrix 3

VendorProduct Version RangeStatus
chevereto chevereto >= 3.7.5, < 4.5.4 affected
chevereto chevereto/chevereto >= 4.0.5, < 4.5.4 affected
chevereto rodber/chevereto-free >= 1.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55417

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Chevereto private profile setting leaks username on /json endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private). This is patched in Chevereto v4.5.4. No known workarounds are available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Chevereto 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Chevereto是Chevereto公司开源的一个图床程序。 Chevereto存在授权问题漏洞，该漏洞源于当用户启用私人资料选项时，`/json` AJAX列表端点未应用权限检查，导致未经验证的调用者知道目标用户ID即可检索该用户的所有公开范围图像并泄露用户名。以下版本受到影响：3.7.5版本至4.5.4之前版本、4.0.5版本至4.5.4之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
chevereto chevereto >= 3.7.5, < 4.5.4 -
chevereto chevereto/chevereto >= 4.0.5, < 4.5.4 -
chevereto rodber/chevereto-free >= 1.0.0 -

II. Public POCs for CVE-2026-55417

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55417

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-55417 (1)

IV. Related Vulnerabilities

Same product: chevereto
Same weakness: CWE-862