The vulnerability is an authorization bypass in the get-album-contents action of the /json route in Chevereto. It allows an attacker to supply an encoded album ID belonging to another user and view the contents of a private album without authentication. This results in disclosure of image filenames, viewer URLs, direct download links, and the images themselves, compromising confidentiality and privacy of users.

All Chevereto installations running a version before 4.5.8 are affected, including versions 4.5.7 and earlier. The issue exists in all releases loaded from the source branch used by the community and is fixed in the 4.5.8 release and later.

The vulnerability has a CVSS score of 6.9, indicating moderate severity. The EPSS score is not available, but the weakness is publicly known and easy to exploit — an attacker only needs to know a valid album ID and a session token exposed on any public page. The vulnerability is not listed in the CISA KEV catalog.