CVE-2026-27833 — HIGH (7.5)

Q: How severe is CVE-2026-27833?

CVE-2026-27833 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-27833?

Check the references section above for vendor advisories and patch information. Affected products include: Piwigo Piwigo.

Vulnerability Description

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Piwigo	Piwigo	< 16.3.0

Related Weaknesses (CWE)

CWE-862

References

https://github.com/Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1cPatch
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2ExploitVendor Advisory
https://piwigo.org/release-16.3.0Release Notes

FAQ

What is CVE-2026-27833?

CVE-2026-27833 is a vulnerability with a CVSS score of 7.5 (HIGH). Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticat...

How severe is CVE-2026-27833?

CVE-2026-27833 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-27833?

Check the references section above for vendor advisories and patch information. Affected products include: Piwigo Piwigo.