PatchSiren cyber security CVE debrief

CVE-2026-111674 Hello-hao CVE debrief

CVE-2026-111674 is a missing authorization vulnerability in Tbed through version 20240319. This vulnerability allows any authenticated user to rename other users' images via the /admin/setImgFileName endpoint. The vulnerability arises because the endpoint does not properly validate user permissions, enabling attackers to supply a victim's imgname, which is exposed in public image URLs and album listings. This can lead to attackers overwriting display names with attacker-chosen text attributed to the victim. Defenders responsible for Tbed deployments should assess exposure and prioritize remediation. System administrators and security teams should verify the version of Tbed in use,

Vendor: Hello-hao
Product: Tbed
CVSS: MEDIUM 5.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-16
Original CVE updated: 2026-10-21
Advisory published: 2026-10-16
Advisory updated: 2026-10-21

Who should care

Defenders responsible for Tbed deployments should assess exposure and prioritize remediation. System administrators and security teams should verify the version of Tbed in use and restrict access to the vulnerable endpoint until a fix is applied.

Why it matters

CVE-2026-111674 is a medium-severity vulnerability in Tbed that allows authenticated users to rename images of other users due to missing authorization in the /admin/setImgFileName endpoint. Defenders should prioritize verifying and remediating this vulnerability in Tbed deployments.

Potential for attackers to overwrite display names with arbitrary text, attributed to victims, through the /admin/setImgFileName endpoint.
Authenticated users could exploit this vulnerability to rename images of other users, potentially leading to confusion or phishing attempts.
Defenders need to verify Tbed versions and ensure proper authorization for image renaming operations to prevent exploitation.
Remediation priority is medium due to the CVSS score of 5.3 and the potential for targeted attacks.

Technical summary

The vulnerability exists in the /admin/setImgFileName endpoint of Tbed, allowing any authenticated user to rename images of other users by providing the victim's imgname. This imgname is exposed in public image URLs and album listings, making it possible for attackers to target specific users. The endpoint lacks proper authorization controls, which enables exploitation. Attackers can leverage this vulnerability to rename images, potentially leading to confusion or phishing attempts. Defenders should prioritize verifying and remediating this vulnerability in Tbed deployments, focusing on restricting access to the /admin/setImgFileName endpoint and ensuring proper authorization for image renaming operations.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Tbed deployments, focusing on restricting access to the /admin/setImgFileName endpoint and ensuring proper authorization for image renaming operations.

Recommended defensive actions

Verify Tbed version and restrict access to the /admin/setImgFileName endpoint
Implement proper authorization for image renaming operations
Monitor for potential exploitation attempts
Update Tbed to a version that addresses this vulnerability, if available
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in Tbed through version 20240319. The /admin/setImgFileName endpoint lacks proper authorization, allowing authenticated users to rename images of other users by supplying the victim's imgname, which is exposed in public image URLs and album listings.

Sources and references

Verified primary and authoritative sources

CVE-2026-111674 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-111674

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-111674 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111674

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Tbed through 20240319 Missing Authorization via setImgFileName Endpoint
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111674.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://hackmd.io/@hieuPenguinnn/tbed-setimgfilename-cross-user-image-metadata-idor

Supplemental source - third-party-advisory
Source reference
Unverified legacy reference

URL: https://github.com/Hello-hao/Tbed/blob/20240319/src/main/java/cn/hellohao/controller/AdminController.java

Supplemental source - technical-description
Source reference
Unverified legacy reference

URL: https://github.com/Hello-hao/Tbed/blob/20240319/src/main/resources/mapper/ImgMapper.xml

Supplemental source - technical-description
Source reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/tbed-through-20240319-missing-authorization-via-setimgfilename-endpoint

Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.