Is CVE-2026-108950 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108950?

CVE-2026-108950 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-108950

Description

Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos and other stored files without any access check.