CVE-2026-57943: LibrePhotos Authentication Bypass Exposes Private Photos

Technical summary

CVE-2026-57943 is a broken object-level authorization (BOLA) vulnerability classified under CWE-639. The SetPhotosShared endpoint in LibrePhotos before version 1.0.0 lacks adequate ownership validation when modifying the shared_to relations of photos. An authenticated attacker can craft requests to alter sharing relationships without the application checking whether the requester owns the photo being shared. This allows circumvention of access controls that should restrict photo visibility to owners and explicitly authorized users. The vulnerability requires valid authentication credentials but no additional special privileges or complex interaction.

Business impact

This vulnerability creates a privacy breach vector for any LibrePhotos deployment. Users cannot trust that their private photos remain confidential; any authenticated user on the platform poses a risk. For organizations using LibrePhotos as a photo management solution—whether for personal archives, family sharing, or collaborative workflows—this represents a material confidentiality loss. Regulatory implications may include GDPR, CCPA, and other privacy frameworks if user data is exposed. Reputation damage, user trust erosion, and potential legal exposure are direct consequences if the flaw is exploited at scale.

Affected systems

LibrePhotos versions prior to 1.0.0 are affected. The vulnerability requires that the attacker has valid authentication credentials on a vulnerable LibrePhotos instance. Any deployment running pre-1.0.0 releases should be considered at risk, particularly those storing sensitive or regulated personal imagery.

Exploitability

The CVSS 3.1 score of 5.9 (MEDIUM) reflects a vulnerability that is exploitable but with moderate friction. Exploitation requires an authenticated account on the target system (PR:L), which means external attackers cannot exploit this directly without first obtaining valid credentials. However, insider threats, compromised accounts, or legitimate users with malicious intent can trivially exercise this flaw. The attack complexity is high (AC:H), suggesting some technical nuance in the exploitation process—likely related to correctly formatting the shared_to relationship manipulation—but this does not significantly raise the practical barrier. No user interaction is needed (UI:N), and the attack works over the network (AV:N). The vulnerability is not widely tracked in active exploitation databases; however, the relative simplicity of the logical flaw means proof-of-concept development by a competent attacker would be straightforward.

Remediation

Upgrade LibrePhotos to version 1.0.0 or later. This version includes fixes to the SetPhotosShared endpoint that enforce proper ownership validation before allowing any modifications to photo sharing relationships. Organizations should verify the patch version against the official LibrePhotos release notes. In the interim, restricting access to LibrePhotos to trusted users, implementing network-level monitoring of share-modification requests, and conducting access logs for anomalous sharing changes may provide temporary mitigation, but are not substitutes for patching.

Patch guidance

Apply the upgrade to LibrePhotos 1.0.0 as soon as practicable. Organizations should test the upgrade in a non-production environment first to ensure compatibility with custom integrations or data migrations. The patch directly addresses the authorization bypass, so no configuration changes are required post-upgrade. Verify the official LibrePhotos repository and announcements for the exact release artifact and any migration guidance. After patching, conduct a brief audit of sharing logs to identify any suspicious permission changes during the vulnerable window.

Detection guidance

Monitor LibrePhotos logs for SetPhotosShared endpoint requests, particularly those that modify shared_to relations for photos not owned by the requesting user. Look for patterns such as a single account rapidly changing sharing permissions on photos across multiple user collections, or requests that reference photo IDs outside the attacker's own collection. Review authentication logs for unusual login patterns or credential reuse. If you have access to raw request logs, search for POST/PATCH requests to SetPhotosShared with shared_to parameters that reference objects the authenticated user did not create. Forensic review of sharing history tables in the database can reveal backdated or anomalous permission grants that predate the vulnerability discovery.

Why prioritize this

Although the CVSS score is MEDIUM, this vulnerability warrants prompt attention because it directly violates user privacy expectations and is easily exploitable by any authenticated user. Privacy breaches carry disproportionate reputational and legal risk compared to availability or integrity flaws. The presence of a working patch and the clear, logical nature of the flaw make this a high-priority remediation target. Organizations handling regulated personal data or maintaining user trust should treat this as a near-term fix, ideally within 30 days of the 1.0.0 release.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects a network-accessible vulnerability that requires authentication and has high attack complexity, yet results in a high confidentiality impact (reading arbitrary private photos) with limited integrity impact (manipulation of sharing metadata). The MEDIUM severity is appropriate for a privacy-focused vulnerability; however, the actual business and regulatory risk may be higher depending on the data classification and use case. Organizations handling healthcare, financial, or child-related imagery should escalate this to HIGH priority regardless of the base CVSS.

Frequently asked questions