Open Source Social Network (OSSN) through version 10.1 has a missing authorization flaw (CWE-862) in its album page handler that permits unauthenticated users to download files via the album/getphoto and album/getcover routes. By iterating sequential file GUIDs, an attacker can bypass any access restrictions and access friend-only photos or other stored files, exposing personal media and potentially confidential data.

The vulnerability affects all OSSN installations running version 10.1 or earlier. The affected product is the Open Source Social Network (OSSN) as maintained by OpenSource-SocialNetwork. No specific patch level is provided in the data, so any instance of OSSN <=10.1 is potentially vulnerable.

The CVSS score of 6.9 indicates medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, as anyone who can reach the web application can craft requests to the vulnerable endpoints. Successful exploitation results in unauthorized download of user photos and stored files, compromising confidentiality without affecting system integrity or availability unless the attacker gains further access.