Executive brief
Ente Museum Server, which provides end-to-end encrypted storage for photos and two-factor authentication (2FA) codes, contains a flaw in its emergency account recovery feature. This feature is designed to allow a trusted contact to help a user regain access after a mandatory waiting period (typically 30 days) to prevent abuse. An attacker who was previously added as a trusted contact can bypass this waiting period entirely, immediately taking over the victim's account, locking them out, and gaining access to their encrypted photos and 2FA seeds for other services like banking or email.
Technical details
An Insecure Direct Object Reference (IDOR) / Authorization Bypass (CWE-639) exists in the `approve-recovery` API endpoint of the Ente Museum Server. The root cause is a failure in the approval handler to verify that the recovery session ID provided in the request body actually belongs to the authenticated caller. An attacker who is already configured as a victim's emergency contact can initiate a recovery, retrieve the session ID, and immediately call the approval endpoint to flip the session status from 'waiting' to 'ready'. This bypasses the 30-to-60-day safety window, allowing the attacker to reset the victim's password and automatically disable the victim's TOTP and passkey 2FA. The issue is fixed in Ente Server PR #11311.
Affected products
- Ente Technologies Museum Server <= 2.0.34
Timeline
- 2026-05-27: other: Vulnerability discovered during audit
- 2026-07-08: patched: Vendor fixed issue in PR #11311
- 2026-07-26: disclosed: Coordinated public disclosure
- 2026-07-29: advisory: CVE-2026-16751 published to NVD