Chevereto v4.5.4 announcement

[Rodolfo]

Hello everybody,

Patch release v4.5.4 will address bugs that have been reported by the community. This release also includes a security patch.

 

[Rodolfo]

Redesigned default Contact page (HTML)

Default contact page (HTML version) now works like any other HTML page, without the contact form.

 

[Rodolfo]

[Security] Fix private profile setting leaking username on /json endpoint

We got a report from geo-chen regarding a security vulnerability in Chevereto, which has been present since Chevereto 3.7.5 (2016-05-30) and it affects all versions up to v4.5.3.

When a user enables the private profile option, visiting their profile HTML route (/username) correctly returns 404. However, the /json AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private).

The system now prevents the output of the private profile username for the concerning endpoint, which is now also restricted only for content owner, managers and admins.

Must read Thread '[GHSA-h4jp-mxfx-g8xp] Private profile setting leaking username on /json endpoint'

Jun 12, 2026

As per our self-discovered vulnerability disclosure, we have just published the security advisory for [Security] Fix private profile setting leaking username on /json endpoint

Affected software

• Chevereto >= 3.7.5, < 4.5.4 (patched)
• rodber/chevereto-free >= 1.0.0

This issue is fixed on Chevereto >= 4.5.4

LINK

Private profile setting leaking username on /json endpoint

### Impact When a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing endpoint does not apply the same...

github.com

• Rodolfo
• ghsa
• Replies: 0
• Forum: Announcements

•