Vulnerability Description
Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/photoview/photoview
- https://github.com/photoview/photoview/blob/81affea602401c2f0207d955919ddcc0670a
- https://github.com/photoview/photoview/commit/20541762fe6d9e0ce363c3d4c55556e4cc
- https://github.com/photoview/photoview/issues/1494
- https://www.vulncheck.com/advisories/photoview-through-2.4.0-authorization-bypas
FAQ
What is CVE-2026-96271?
CVE-2026-96271 is a vulnerability with a CVSS score of 7.1 (HIGH). Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attacke...
How severe is CVE-2026-96271?
CVE-2026-96271 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-96271?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.