Hello-hao CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Hello-hao CVE published 2026-10-16

CVE-2026-111674

CVE-2026-111674 is a missing authorization vulnerability in Tbed through version 20240319. This vulnerability allows any authenticated user to rename other users' images via the /admin/setImgFileName endpoint. The vulnerability arises because the endpoint does not properly validate user permissions, enabling attackers to supply a victim's imgname, which is exposed in public image URLs and album listings. [truncated]