Blossom vulnerabilities
CVEs whose affected-version data names the Blossom package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-119659Medium· 5.4Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to…
▾ Sunlitblossom-editor · BlossomEPSS 0.26%via CVEORG
CVE-2026-119644Medium· 5.4PoCBlossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/ba…
▾ Twilightblossom-editor · BlossomEPSS 0.33%via CVEORG