CVE-2026-57943: Librephotos

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation. Attackers can manipulate shared_to relations without proper owner checks to read arbitrary private photos belonging to other users.

Affected products

• Librephotos Librephotos: before 1.0.0 (fixed in 1.0.0)

Published 2026-06-29. Last modified 2026-07-14.