CVE-2026-119644

CVSS 5.4 (medium) · published 2026-10-30

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.

Weakness: CWE-639

Source: NVD CVE-2026-119644

References

• https://github.com/blossom-editor/blossom
• https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureController.java#L56-L109
• https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureService.java#L222-L232
• https://github.com/blossom-editor/blossom/issues/214
• https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete
• https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-picture-delete-and-star-endpoints
• https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.