CVE tracker
CVE-2026-119644
CVE-2026-119644Medium 5.3
Research and translation in progress – available shortly.
Original description (NVD)
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
NVD references (6)
- https://github.com/blossom-editor/blossom
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/back…
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/back…
- https://github.com/blossom-editor/blossom/issues/214
- https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete
- https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-picture-delete-and-star-…
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.