CVE-2026-111674: Authorization Bypass Through User-Controlled Key in Hello-hao Tbed
Description
CVE-2026-111674 is an authorization bypass vulnerability in Hello-hao's Tbed product through version 0. It allows any authenticated user to rename images belonging to other users by exploiting the /admin/setImgFileName endpoint. Attackers can supply a victim's image name, which is publicly exposed, to overwrite display names with attacker-chosen text attributed to the victim. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity.
CVSS v4.0
Score 5.3medium
Affected software
Hello-hao
Tbed
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Hello-hao Tbed (up to version 0) involves missing authorization checks on the /admin/setImgFileName endpoint. This flaw permits any authenticated user to rename images owned by other users by providing the victim's image name, which is publicly accessible via image URLs and album listings. This can lead to display name manipulation of images without the victim's consent.
Potential Impact
An attacker with authentication can rename images of other users, potentially causing misinformation or misattribution by changing image display names. This could affect user trust and content integrity but does not appear to allow further privilege escalation or data disclosure beyond image renaming.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /admin/setImgFileName endpoint to trusted users only, or implement additional authorization checks to ensure users can only rename their own images.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-16T14:31:18.123Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad264152cdf04f65619959a
Added to database: 10/16/2026, 17:51:17 UTC
Last enriched: 10/16/2026, 18:33:36 UTC
Last updated: 10/16/2026, 19:03:25 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.