Live › vulnerability › CVE-2026-111674
Go to dashboardTbed through 20240319 has a missing authorization check on the /admin/setImgFileName endpoint. Any authenticated user can overwrite the display name of another user's image, using the victim's public imgname.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations of Tbed through 20240319 where ordinary users can sign in. Sites with only administrators as accounts, or with registration closed, are less exposed. The sources do not name a fixed version.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim.
This page as .md · .json · in your agent: get_signal("CVE-2026-111674")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.