Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated… (CVE-2026-108950)
Description
Open Source Social Network (OSSN) versions up to 10.1 have a missing authorization vulnerability in the ossn_album_page_handler component. This flaw allows unauthenticated attackers to download files via album/getphoto and album/getcover endpoints. Attackers can enumerate sequential file GUIDs to access friends-only album photos and other stored files without any access control checks. The vulnerability has a CVSS 3.1 score of 5.3, indicating medium severity.
CVSS v3.1
Score 5.3medium
Affected software
pkg:github/opensource-socialnetwork/opensource-socialnetworkRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OSSN through version 10.1 contains a missing authorization vulnerability (CWE-862) in the ossn_album_page_handler function. This vulnerability permits unauthenticated attackers to download files by accessing album/getphoto and album/getcover endpoints. The flaw enables enumeration of sequential file GUIDs, allowing retrieval of photos and files intended to be restricted to friends only, bypassing any access control mechanisms.
Potential Impact
An attacker can access and download files, including friends-only album photos, without authentication or authorization. This leads to unauthorized disclosure of potentially sensitive user content. There is no indication of impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the affected endpoints if possible or implement additional access control measures at the network or application layer to prevent unauthorized file downloads.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2j53-hvmv-r3h4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-108950"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6acd556e2cdf04f656da88cc
Added to database: 10/12/2026, 21:47:26 UTC
Last enriched: 10/12/2026, 22:08:08 UTC
Last updated: 10/12/2026, 22:08:08 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.