CVE-2026-27833
Received Received - Intake
Unauthorized Access in Piwigo pwg.history.search API Pre

Publication date: 2026-04-03

Last updated on: 2026-04-09

Assigner: GitHub, Inc.

Description
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-03
Last Modified
2026-04-09
Generated
2026-06-16
AI Q&A
2026-04-04
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27833
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
piwigo piwigo to 16.3.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Piwigo, an open source photo gallery application. Before version 16.3.0, the pwg.history.search API method was registered without the admin_only option. This means that unauthenticated users could access the full browsing history of all gallery visitors, which should have been restricted.

Impact Analysis

The vulnerability allows unauthenticated users to view the complete browsing history of all visitors to the gallery. This could lead to privacy breaches, as sensitive information about user behavior and activity on the site could be exposed to unauthorized parties.

Mitigation Strategies

The vulnerability in Piwigo allows unauthenticated users to access the full browsing history of all gallery visitors via the pwg.history.search API method. This issue has been patched in version 16.3.0.

To mitigate this vulnerability immediately, you should upgrade your Piwigo installation to version 16.3.0 or later, where the pwg.history.search API method is properly restricted with the admin_only option.

Compliance Impact

This vulnerability allows unauthenticated users to access the full browsing history of all gallery visitors, which could lead to unauthorized disclosure of personal data.

Such unauthorized access to personal or visitor data may impact compliance with data protection regulations like GDPR, which require protection of personal data against unauthorized access.

Similarly, regulations like HIPAA that mandate safeguarding sensitive information could be affected if the browsing history contains protected health information or other sensitive data.

Therefore, this vulnerability poses a risk to compliance with common standards and regulations that require confidentiality and protection of user data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27833. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart