Threats affecting pkg:github/ente/ente

A vulnerability in Ente's server prior to image 2026.07.09 allowed an authorization bypass in the emergency contact recovery approval process. An accepted emergency contact could misuse the approval endpoint by submitting their own identifier to prematurely transition the victim's recovery session state and access recovery information before the configured notice period expired. Additionally, similar insufficient authorization checks affected reject and stop recovery transitions, potentially allowing cancellation of recovery sessions by users not party to them. The flaw requires the attacker to already be an accepted emergency contact and does not grant recovery rights for arbitrary accounts. This issue is fixed in server image 2026.07.09.