CVE-2026-27833
Unauthorized Access in Piwigo pwg.history.search API Pre
Publication date: 2026-04-03
Last updated on: 2026-04-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| piwigo | piwigo | to 16.3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Piwigo, an open source photo gallery application. Before version 16.3.0, the pwg.history.search API method was registered without the admin_only option. This means that unauthenticated users could access the full browsing history of all gallery visitors, which should have been restricted.
How can this vulnerability impact me? :
The vulnerability allows unauthenticated users to view the complete browsing history of all visitors to the gallery. This could lead to privacy breaches, as sensitive information about user behavior and activity on the site could be exposed to unauthorized parties.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in Piwigo allows unauthenticated users to access the full browsing history of all gallery visitors via the pwg.history.search API method. This issue has been patched in version 16.3.0.
To mitigate this vulnerability immediately, you should upgrade your Piwigo installation to version 16.3.0 or later, where the pwg.history.search API method is properly restricted with the admin_only option.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated users to access the full browsing history of all gallery visitors, which could lead to unauthorized disclosure of personal data.
Such unauthorized access to personal or visitor data may impact compliance with data protection regulations like GDPR, which require protection of personal data against unauthorized access.
Similarly, regulations like HIPAA that mandate safeguarding sensitive information could be affected if the browsing history contains protected health information or other sensitive data.
Therefore, this vulnerability poses a risk to compliance with common standards and regulations that require confidentiality and protection of user data.