Live › vulnerability › CVE-2026-119644
Blossom through version 1.17.1 does not check ownership when a logged-in non-readonly user acts on pictures by ID. An attacker can permanently delete other users' images and stored files through the picture delete or batch delete endpoints, or change their star status through the star endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams that run a self-hosted Blossom instance with multiple user accounts where some accounts are non-readonly. The sources describe authenticated users only, so an instance with no accounts other than trusted administrators is less exposed. unknown whether other configurations are safe.
No product ranges from the sources yet.
1.17.1 are affected.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
This page as .md · .json · in your agent: get_signal("CVE-2026-119644")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.