CVE-2026-104875
Received Received - Intake

Authorization Bypass in Ente Emergency Recovery

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-14
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-104875
EUVD
EUVD-2026-100469

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ente ente < 0.1.18
ente ghcr.io/ente/server < 2026.07.09

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Ente's end-to-end encrypted cloud services. It involves an authorization bypass in the POST /emergency-contacts/approve-recovery endpoint. Attackers could exploit it by submitting their own userID to approve emergency recovery sessions for other users, transitioning sessions from WAITING to READY state prematurely. This allowed them to access recovery information before the owner's configured notice period expired.

Impact Analysis

If you use Ente's services and have added emergency contacts, an attacker who is one of your emergency contacts could exploit this to access your recovery information before you intended. This could lead to unauthorized account recovery or data access. The impact requires the attacker to already be an accepted emergency contact.

Mitigation Strategies

Update the server image to version 2026.07.09 or later to address the vulnerability in the POST /emergency-contacts/approve-recovery endpoint and related issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104875. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart