CVE-2026-16645

Awaiting Analysis Awaiting Analysis - Queue

Missing Authorization in PhotoSwipe Gallery Allows Forceful Browsing

Publication date: 2026-08-25

Last updated on: 2026-08-28

Assigner: Drupal.org

Description

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-28

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-16645

EUVD

EUVD-2026-66202

Affected Vendors & Products

Vendor	Product	Version / Range
mlhess	photoswipe_responsive_javascript_modal_image_gallery	From 0.0.0 (inc) to 3.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a Missing Authorization vulnerability in the Drupal PhotoSwipe module. It allows unauthorized users to access restricted content through forceful browsing, meaning they can directly access URLs or resources they should not have permission to view.

Detection Guidance

To detect this vulnerability, check if you are running PhotoSwipe - Responsive JavaScript Modal Image Gallery versions 0.0.0 to 3.2.0. Inspect your Drupal modules directory for the presence of this module and verify its version.

Impact Analysis

If exploited, this vulnerability could allow attackers to view sensitive or private content that should be restricted. This may lead to data leaks, unauthorized access to user information, or other security breaches depending on the exposed content.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health data. Organizations may face legal penalties, fines, or reputational damage due to data exposure.

Mitigation Strategies

Update PhotoSwipe - Responsive JavaScript Modal Image Gallery to version 3.2.1 or later to address the missing authorization vulnerability.

Hi! I’m here to help you understand CVE-2026-16645. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70