Ente’s server allowed a POST to /emergency-contacts/approve-recovery that accepted a client‑supplied userID and updated only the provided recovery-session UUID. A contact that had already been added and accepted could submit its own identifier, move the victim’s session from WAITING to READY, clear the wait_till flag, retrieve recovery information, and complete account recovery before the owner‑configured notice period expired. This bypass does not grant recovery rights to arbitrary accounts and requires the attacker to have prior access as an emergency contact; a similar insufficiently scoped update also affected reject and stop recovery transitions for unknown sessions.

The vulnerability applied to Ente self‑hosted server images released prior to 2026.07.09, specifically the server package hosted on ente:ente and the container image on ente:ghcr.io/ente/server. Users running any entrustn server version before that build are affected.

The CVSS score of 7.1 classifies the flaw as high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already be an accepted emergency contact and know a victim’s active recovery‑session UUID, implying that the attack vector is most likely remote through the web API or web interface when the victim is online. The impact is the premature restoration of account access, potentially exposing the victim’s data before the intended notice delay.