CVE-2026-104875

Deferred Deferred - Pending Action

Authorization Bypass in Ente Emergency Recovery

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104875

EUVD

EUVD-2026-100469

Affected Vendors & Products

Vendor	Product	Version / Range
ente	ente	< 0.1.18
ente	ghcr.io/ente/server	< 2026.07.09

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Ente's end-to-end encrypted cloud services. It involves an authorization bypass in the POST /emergency-contacts/approve-recovery endpoint. Attackers could exploit it by submitting their own userID to approve emergency recovery sessions for other users, transitioning sessions from WAITING to READY state prematurely. This allowed them to access recovery information before the owner's configured notice period expired.

Detection Guidance

This vulnerability affects Ente's emergency recovery functionality prior to server image 2026.07.09. To detect it, check if your Ente server version is below 2026.07.09. Use commands like 'docker inspect <container_name> | grep Image' to verify the server image version. If the version is older, the system is vulnerable.

Impact Analysis

If you use Ente's services and have added emergency contacts, an attacker who is one of your emergency contacts could exploit this to access your recovery information before you intended. This could lead to unauthorized account recovery or data access. The impact requires the attacker to already be an accepted emergency contact.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data during account recovery, potentially violating GDPR's data protection principles (e.g., integrity, confidentiality) and HIPAA's access controls. Unauthorized recovery approvals may expose personal or health information without proper authorization, undermining compliance with these standards.

Mitigation Strategies

Update the server image to version 2026.07.09 or later to address the vulnerability in the POST /emergency-contacts/approve-recovery endpoint and related issues.

Hi! I’m here to help you understand CVE-2026-104875. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70