CVE-2026-111674
Tbed through 20240319 Missing Authorization via setImgFileName Endpoint
Hello-hao Tbed
CVSS
5.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 21 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim.
Text from CVE List
Affected versions 1
- Tbedaffected: all versions through 20240319CVE List
References 4
- vulncheck.com/advisories/tbed-through-20240319-missing-authorization-via-setimgfilename-endpointAdvisoryvia CVE List
- hackmd.io/@hieuPenguinnn/tbed-setimgfilename-cross-user-image-metadata-idorExploitvia CVE List
- github.com/Hello-hao/Tbed/blob/20240319/src/main/java/cn/hellohao/controller/AdminController.java#L158-L176Referencevia CVE List
- github.com/Hello-hao/Tbed/blob/20240319/src/main/resources/mapper/ImgMapper.xml#L171-L189Referencevia CVE List