---
id: CVE-2026-111674
title: Tbed through 20240319 Missing Authorization via setImgFileName Endpoint
summary: >-
  Tbed through 20240319 contains a missing authorization vulnerability that
  allows any authenticated user to rename other users' images through the
  /admin/setImgFileName endpoint. Attackers can supply a victim's imgname,
  exposed in public …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Hello-hao
product: Tbed
affected:
  - Tbed <= 20240319
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:39:34.559Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111674'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/tbed-setimgfilename-cross-user-image-metadata-idor
  - url: >-
      https://github.com/Hello-hao/Tbed/blob/20240319/src/main/java/cn/hellohao/controller/AdminController.java#L158-L176
  - url: >-
      https://github.com/Hello-hao/Tbed/blob/20240319/src/main/resources/mapper/ImgMapper.xml#L171-L189
  - url: >-
      https://www.vulncheck.com/advisories/tbed-through-20240319-missing-authorization-via-setimgfilename-endpoint
    label: >-
      VulnCheck Advisory: Tbed through 20240319 Missing Authorization via
      setImgFileName Endpoint
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.666Z'
---

## Overview

Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim.

## Affected

- `Tbed <= 20240319`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.