This vulnerability involves incorrect authorization (CWE-863) in the emergency recovery approval process of Ente Museum Server. Specifically, an attacker authenticated as an emergency contact can circumvent the intended waiting period for account recovery by manipulating the approve-recovery API request. This flaw enables unauthorized account takeover by bypassing security controls designed to protect the victim's account during emergency recovery. The vulnerability is publicly disclosed but lacks a CVSS score and confirmed remediation status.

An attacker with emergency contact privileges can bypass the recovery waiting period and gain unauthorized access to a victim's account, effectively taking over the account. This compromises account integrity and could lead to unauthorized actions under the victim's identity. No evidence of active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should review emergency contact configurations and monitor for suspicious approve-recovery API requests. No official fix or temporary workaround has been published by the vendor.