The vulnerability resides in the /admin/setImgFileName endpoint of Tbed, which lacks proper authorization checks. An authenticated user can supply the filename of another user’s image, identified by the publicly visible imgname, and change its display name to attacker‑chosen text. This is a form of data modification that can misattribute photos and damage user reputation. The weakness is marked as CWE‑639, representing missing authorization of a resource for misuse.

Affected is the Tbed application authored by Hello‑hao. The flaw exists in versions up to 20240319. No other versions are listed, so only builds derived from or identical to the 20240319 snapshot are impacted.

The CVSS score of 5.3 indicates a moderate severity level, reflecting that exploitation requires an authenticated session. EPSS data is not publicly available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting limited current exploitation reports. Nevertheless, the lack of authorization makes the endpoint reachable by any logged‑in user, so administrators should treat this as an active risk when deploying the affected version.