CyberRota Analysis
AI-GeneratedAn insecure direct object reference vulnerability in PhotoPrism allows any user with a valid preview token to access and download the original-resolution cover photos of albums they are not authorized to view. This could lead to unauthorized exposure of sensitive album information, impacting user privacy. Organizations using PhotoPrism should prioritize addressing this issue to protect user data and maintain trust.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified album before serving the cover image. An attacker with any valid preview token can enumerate and download album cover images belonging to other users.