No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 30 Oct 2026
- Last modified upstream: 05 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/blossom-editor/blossom
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureController.java#L56-L109
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureService.java#L222-L232
- https://github.com/blossom-editor/blossom/issues/214
- https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete
- https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-picture-delete-and-star-endpoints
- https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete
- Analysis, summary and remediation
- © VulnCrest