MEDIUM 5.3 NVD
CVE-2026-119644
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
References
- https://github.com/blossom-editor/blossom
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/ja
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/ja
- https://github.com/blossom-editor/blossom/issues/214
- https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.