From 81b8d896b5612da73261ee530f4b16490d398843 Mon Sep 17 00:00:00 2001
From: timonrieger <mail@timonrieger.de>
Date: Wed, 29 Apr 2026 22:54:05 +0200
Subject: [PATCH] fix(server): replace album user-not-found message to prevent
 UUID-existence oracle

Album owners could probe arbitrary UUIDs via the add-user endpoint and
determine whether they belonged to registered accounts by receiving
'User not found'. The message is now ambiguous about whether the ID was
unrecognised or the user is inactive.
---
 server/src/services/album.service.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/src/services/album.service.ts b/server/src/services/album.service.ts
index 24b0668eb2..0955e0563d 100644
--- a/server/src/services/album.service.ts
+++ b/server/src/services/album.service.ts
@@ -107,7 +107,7 @@ export class AlbumService extends BaseService {
     for (const { userId } of albumUsers) {
       const exists = await this.userRepository.get(userId, {});
       if (!exists) {
-        throw new BadRequestException('User not found');
+        throw new BadRequestException('Invalid user');
       }
 
       if (userId == auth.user.id) {
@@ -302,7 +302,7 @@ export class AlbumService extends BaseService {
 
       const user = await this.userRepository.get(userId, {});
       if (!user) {
-        throw new BadRequestException('User not found');
+        throw new BadRequestException('Invalid user');
       }
 
       await this.albumUserRepository.create({ userId, albumId: id, role });