CVE-2026-96271

HighCVSS 7.1

Published: 23/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

Authorization bypass vulnerability in Photoview through 2.4.0 in the shareAlbum GraphQL mutation allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link.

Risk Assessment

An attacker can gain access to private photos of other users, violating privacy and potentially leading to sensitive data leakage.

Recommendation

Upgrade Photoview to a version newer than 2.4.0 if available, and implement access controls on the shareAlbum mutation.

Other vulnerabilities in Photoview

CVE-2026-96673High
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.

Original NVD description (English source)

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS