• maxprime@lemmy.ml
    link
    fedilink
    English
    arrow-up
    0
    ·
    14 days ago

    All (raw) image endpoints in ImageByNameController, ImageController & RemoteImageController are unauthenticated

    • This allows probing on whether a specific image exists on the server by guessing item id’s (which can be done without too much trouble, as item ids are based on filepath and filename information) and then checking on what content (movies, series etc) exist on a given server, without having an account.