Threats affecting pkg:github/librephotos

LibrePhotos versions before 1.0.0 have a broken object-level authorization vulnerability in the SetPhotosShared endpoint. This flaw allows authenticated users to bypass ownership validation and grant themselves access to other users' private photos by manipulating shared_to relations. The vulnerability is fixed in version 1.0.0.