CVE-2018-1000551

Trovebox up to version 4.0.0-rc6 is affected by a PHP type juggling flaw in the album view component that can bypass authentication. Exploitation is reported to be viable via an HTTP request. The issue’s root cause is a PHP type juggling vulnerability in the album view component, allowing bypass ...