Answer in brief
CVE-2026-104875 records a High severity (CVSS 7.1) vulnerability in Ente: Accepted emergency contact can bypass the recovery notice period. The current sources do not mark it as known exploited. The current feed maps ente/ente (generic), ente/ghcr.io/ente/server (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps ente/ente (generic), ente/ghcr.io/ente/server (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| ente/entegeneric | <0.1.18 | 0.1.18 |
| ente/ghcr.io/ente/servergeneric | <2026.07.09 | 2026.07.09 |
Published upstream
Oct 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 13, 2026
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09.
Quoted source text, attributed separately from HOL analysis.