Chevereto allows an attacker to discover a private profile’s username through an /json AJAX listing endpoint. When the private profile option is enabled, the HTML profile route correctly returns 404, but the JSON endpoint does not perform the same access check. An unauthenticated caller who knows a user’s numerical identifier can thereby retrieve the user’s publicly scoped images and simultaneously expose the username that should be kept private. This flaw is a classic case of unauthorized access, identified as CWE-862.

Chevereto products, including the official distribution. Versions beginning with 3.7.5 and up through 4.5.3 are vulnerable. The issue was fixed in Chevereto 4.5.4; no additional vendor updates are required beyond that release.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of <1% indicates very low exploitation probability, and the vulnerability is not listed in CISA KEV. The likely attack vector is network-based, inferred from the fact that send requests to the /json endpoint after knowing a user identifier; no privileged access or complex intermediates are required.