{"id":"CVE-2026-16751","summary":"Ente Museum Server Authorization Bypass Vulnerability","details":"Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted `approve-recovery` API request.","modified":"2026-09-25T03:46:20.736424217Z","published":"2026-07-29T13:16:00.450Z","database_specific":{"cna_assigner":"certcc","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16751.json"},"references":[{"type":"WEB","url":"https://github.com/ente/ente/tree/v2.0.34"},{"type":"WEB","url":"https://vokecyber.com/research/cve-2026-16751-ente-emergency-recovery-bypass"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16751.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16751"},{"type":"FIX","url":"https://github.com/ente/ente/commit/4789ae67368c1f9ba7eb1a0e2c0588e4a9a55746"},{"type":"ARTICLE","url":"https://vokecyber.com/blog/cve-2026-16751-ente-emergency-recovery-bypass"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ente/ente","events":[{"introduced":"0"},{"fixed":"4789ae67368c1f9ba7eb1a0e2c0588e4a9a55746"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"2.0.34"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["photos-v1.3.58-beta","photos-desktop-v1.7.26-beta","auth-v4.4.24-rc","auth-v4.4.24","auth-v4.4.24-beta","photos-v1.3.57-beta","photos-desktop-v1.7.25-beta","photos-v1.3.57-rc","photos-v1.3.57","locker-v1.0.6-rc","locker-v1.0.6","locker-v1.0.6-beta","photos-v1.3.56","photos-v1.3.56-beta","photosd-v1.7.24","photos-v1.3.44","photosd-v1.7.23","locker-v1.0.3","locker-v1.0.2","ensu-v0.1.15","photosd-v1.7.22","ensu-v0.1.14","ensu-v0.1.12","ensu-v0.1.11","ensu-v0.1.10","server/ghcr","locker-v1.0.1","photosd-v1.7.21","photosd-v1.7.20","photosd-v1.7.19","ensu-v0.1.8","ensu-v0.1.7","ensu-v0.1.6","ensu-v0.1.5","ensu-v0.1.4","ensu-v0.1.3","locker-v1.0.0","auth-v4.4.16","locker-v0.1.4","photosd-v1.7.17","photos-v1.2.20","photosd-v1.7.16","photosd-v1.7.15","photos-v1.2.10","photos-v1.2.8","photos-v1.2.4","auth-v4.4.3","auth-v4.4.2","photosd-v1.7.14","photosd-v1.7.13","auth-v4.3.8","photos-v1.0.10","auth-v4.3.6","photosd-v1.7.12","photos-v1.0.2","photosd-v1.7.11","photos-v1.0.0","auth-v4.3.3","photosd-v1.7.10","cli-v0.2.3","photos-v0.9.95","photosd-v1.7.9","auth-v4.3.2","auth-v4.3.1","auth-v4.3.0","auth-v4.2.9","photos-v0.9.79","photos-v0.9.81","auth-v4.2.8","auth-v4.2.7","auth-v4.2.6","photosd-v1.7.8","auth-v4.2.4","photos-v0.9.76","photos-v0.9.75","auth-v4.2.3","auth-v4.2.2","auth-v4.2.1","auth-v4.2.0","photos-v0.9.72","photos-v0.9.71","auth-v4.1.6","photos-v0.9.66","auth-v4.1.4","auth-v4.1.2","photosd-v1.7.7","photos-v0.9.65","auth-v4.1.1","photos-v0.9.53","auth-v4.1.0","photosd-v1.7.6","cli-v0.2.2","photos-v0.9.52","photos-v0.9.49","photos-v0.9.48","photos-v0.9.47","photos-v0.9.46","photosd-v1.7.5","auth-v4.0.2","auth-v4.0.1","photos-v0.9.44","cli-v0.2.1","cli-v0.2.0","photos-v0.9.42","photos-v0.9.41","auth-v4.0.0","auth-v3.1.8","photos-v0.9.35","photosd-v1.7.4","photos-v0.9.30","photos-v0.9.27","auth-v3.1.3","photosd-v1.7.3","cli-v0.1.18","auth-v3.1.1","auth-v3.1.0","photos-v0.9.16","photos-v0.9.14","photosd-v1.7.2","photos-v0.9.7","photos-v0.9.5","auth-v3.0.13","cli-v0.1.17","auth-v3.0.17","photos-v0.9.2","cli-v0.1.16","photosd-v1.7.1","photos-v0.9.0","auth-v3.0.12","auth-v3.0.11","cli-v0.1.15","auth-v3.0.8","photos-v0.8.131","auth-v3.0.7","auth-v3.0.6","photos-v0.8.128","photos-v0.8.127","cli-v0.1.14","photosd-v1.7.0","auth-v3.0.4","auth-v3.0.3","auth-v3.0.2","auth-v3.0.1","auth-v3.0.0","auth-v2.0.58","photos-v0.8.94","photos-v0.8.81","photos-v0.8.79","auth-v2.0.55","auth-v2.0.54","auth-v2.0.53","auth-v2.0.52","auth-v2.0.51","photos-v0.8.75","photos-v0.8.74","auth-v2.0.50","cli-v0.1.13","auth-v2.0.48","auth-v2.0.47","auth-v2.0.46","photos-v0.8.70","cli-v0.1.12","photos-v0.8.68","auth-v2.0.41","auth-v2.0.40","auth-v2.0.36","cli-v0.1.11","nightly","v2.0.34","v2.0.30","v2.0.28","v2.0.26","v2.0.25","v2.0.24","v2.0.22","v2.0.19","v2.0.18","v2.0.15","v2.0.14","v2.0.13","v2.0.12","v2.0.11","v2.0.10","v2.0.7","v2.0.5","v2.0.1","v2.0.0","v1.0.56","v1.0.55","v1.0.54","v1.0.52","v1.0.51","v1.0.50","v1.0.41","v1.0.40","v1.0.39","v1.0.37","v1.0.34","v1.0.32","v1.0.31","v1.0.28","v1.0.25","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.14","v1.0.12","v1.0.11","v1.0.10","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.3","v1.0.2","v1.0.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16751.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}