Description

Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos and other stored files without any access check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-12T13:17:27.840Z",
  "pubdate": "2026-10-12T13:17:27.840Z",
  "executiveSummary": "Open Source Social Network (OSSN) versions through 10.1 contain a critical missing authorization vulnerability residing within the album management subsystem. This vulnerability permits unauthenticated actors to bypass access control mechanisms and retrieve sensitive media files, including those restricted to 'friends-only' visibility. The flaw originates from improper authorization checks during the processing of album-related requests. The risk implications are significant, as attackers can perform unauthorized data exfiltration through simple enumeration of file GUIDs (Globally Unique Identifiers). Since the application fails to validate the requester's identity or permissions against the requested resource, any remote, unauthenticated attacker can effectively scrape private user photos and stored media files. This vulnerability represents a major privacy breach, as it exposes non-public user content to the public internet, potentially leading to identity theft or the leakage of sensitive personal information. The ease of exploitation via automated enumeration makes this a high-priority security concern for deployments utilizing affected versions of the platform.",
  "technicalDetails": "The vulnerability is situated within the ossn_album_page_handler component of the Open Source Social Network (OSSN) platform, specifically affecting the handling of the album/getphoto and album/getcover endpoints. The root cause is a failure to enforce authorization logic prior to serving file content to the end-user. When an HTTP request is made to retrieve a photo or album cover, the application logic processes the request via the handler without verifying if the requesting user possesses the requisite privileges to view the specific object.\nIn a standard secure configuration, an application is expected to check the requester's authentication token and evaluate the resource's ACL (Access Control List) before granting access. In this instance, the vulnerable component fails to perform an authentication or authorization check. Consequently, the handler assumes the request is valid regardless of the user's current session status or relationship with the content owner.\nThe exploitation flow is straightforward and does not require complex payloads. An attacker can initiate a brute-force or linear enumeration attack by systematically incrementing the integer-based GUIDs associated with album photos and covers. By crafting GET requests targeting album/getphoto/<GUID> or album/getcover/<GUID>, the attacker bypasses any front-end UI restrictions that might normally hide these files from unauthorized users. Because the back-end PHP handler responsible for fetching these files from storage lacks session validation, the server responds with the requested file binary.\nThis vulnerability is remotely exploitable over the network and requires zero authentication. The impact is a total compromise of content confidentiality for all hosted user media that is not public. By iterating through sequential or predictable GUID values, an attacker can mirror the contents of a user's private albums, retrieve archived photos, and gain unauthorized access to any media stored within the application's file repository. The post-exploitation impact includes the systematic extraction of private data, violation of user privacy policies, and the potential exposure of sensitive or personally identifiable information (PII) that users intended to keep restricted to their social circle."
}