This vulnerability (CVE-2026-16751) involves an incorrect authorization (CWE-863) flaw in the emergency recovery approval mechanism of Ente Museum Server. Specifically, an attacker authenticated as a victim's emergency contact can exploit the approve-recovery API to bypass the intended recovery waiting period, enabling account takeover. The issue affects the emergency recovery workflow, allowing privilege escalation without proper authorization checks. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with authenticated access as a victim's emergency contact can bypass security controls designed to enforce a recovery waiting period, resulting in unauthorized account takeover. This compromises the integrity of user accounts but does not directly impact confidentiality or availability according to the CVSS vector (no confidentiality impact, high integrity impact, no availability impact).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict emergency contact privileges where possible and monitor for suspicious approve-recovery API usage if logging is available.