CVE-2026-108950
Received Received - Intake

Unauthenticated File Download in Open Source Social Network

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos and other stored files without any access check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108950
EUVD
EUVD-2026-97357

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opensource-socialnetwork opensource-socialnetwork 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108950 is a missing authorization vulnerability in Open Source Social Network (OSSN) versions up to 10.1. It allows unauthenticated attackers to download files via album/getphoto and album/getcover endpoints by exploiting sequential file GUIDs. Attackers can access friends-only album photos and other restricted files without proper access checks.

Detection Guidance

Check for unauthorized access to album photos or covers by testing endpoints like /album/getphoto and /album/getcover with sequential GUIDs. Monitor logs for repeated requests to these endpoints from unauthenticated users.

Impact Analysis

This vulnerability enables attackers to bypass privacy settings and access private album photos or other stored files without authorization. It can lead to unauthorized data exposure, privacy violations, and potential misuse of sensitive user content. Systems running unpatched OSSN versions are at risk of file access without proper controls.

Compliance Impact

This vulnerability likely violates privacy and data protection requirements under GDPR and HIPAA by allowing unauthorized access to sensitive user data. It undermines compliance with data confidentiality and access control mandates, potentially leading to legal and regulatory penalties for affected organizations.

Mitigation Strategies

Apply the latest patches from the OSSN GitHub repository, particularly the commit cb7c24e70f8c4470ee485caac4889885d2e120b3. Ensure access control checks are enforced in ossn_album_page_handler for getphoto and getcover cases.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108950. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart