CVE-2026-108950 — Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes
Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files …
Published: 2026-10-12 · CVSS: 6.9 · CVSS 4.0
Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos and other stored files without any access check.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7