CVE-2026-27833

Received Received - Intake

Unauthorized Access in Piwigo pwg.history.search API Pre

Publication date: 2026-04-03

Last updated on: 2026-04-09

Assigner: GitHub, Inc.

Description

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-03

Last Modified

2026-04-09

Generated

2026-07-06

AI Q&A

2026-04-04

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27833

Affected Vendors & Products

Vendor	Product	Version / Range
piwigo	piwigo	to 16.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Compliance Impact

This vulnerability allows unauthenticated users to access the full browsing history of all gallery visitors, which could lead to unauthorized disclosure of personal data.

Such unauthorized access to personal or visitor data may impact compliance with data protection regulations like GDPR, which require protection of personal data against unauthorized access.

Similarly, regulations like HIPAA that mandate safeguarding sensitive information could be affected if the browsing history contains protected health information or other sensitive data.

Therefore, this vulnerability poses a risk to compliance with common standards and regulations that require confidentiality and protection of user data.

Executive Summary

This vulnerability exists in Piwigo, an open source photo gallery application. Before version 16.3.0, the pwg.history.search API method was registered without the admin_only option. This means that unauthenticated users could access the full browsing history of all gallery visitors, which should have been restricted.

Impact Analysis

The vulnerability allows unauthenticated users to view the complete browsing history of all visitors to the gallery. This could lead to privacy breaches, as sensitive information about user behavior and activity on the site could be exposed to unauthorized parties.

Mitigation Strategies

The vulnerability in Piwigo allows unauthenticated users to access the full browsing history of all gallery visitors via the pwg.history.search API method. This issue has been patched in version 16.3.0.

To mitigate this vulnerability immediately, you should upgrade your Piwigo installation to version 16.3.0 or later, where the pwg.history.search API method is properly restricted with the admin_only option.

Hi! I’m here to help you understand CVE-2026-27833. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70