EUVD-2026-114075 reports authorization bypass in Blossom through 1.17.1
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- blossom-editor
- Product
- Blossom
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-114075 describes an authorization bypass in Blossom through 1.17.1, scored 5.3/10 (CVSS v3.1). Per the listing, authenticated users can access other users' folders by supplying another user's folder ID.
If you use blossom-editor
Upgrade Blossom to a version later than 1.17.1 when a fix is available
Restrict shared folder access until patched
Update Blossom to a version later than 1.17.1 once a fix is released
Audit picture delete and batch operations for unexpected changes
Restrict non-readonly accounts to trusted users
What the sources say 2
· Mastodon: “Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id.” Source
· Mastodon: “Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids.” Source