CVE-2026-72540
Received Received - Intake

Insecure Direct Object Reference in PhotoPrism Exposes Album Cover Photos

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified album before serving the cover image. An attacker with any valid preview token can enumerate and download album cover images belonging to other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72540
EUVD
EUVD-2026-56010

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
photoprism photoprism *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an insecure direct object reference in PhotoPrism. It allows any user with a valid preview token to access the original-resolution cover photo of any album, even if they are not authorized to view that album. The AlbumCover handler fails to check if the requesting user has permission to access the specified album before serving the cover image.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access to album cover images. Check server logs for requests to the AlbumCover endpoint with valid preview tokens but no proper authorization. Use tools like curl to test endpoints manually: curl -H 'Authorization: Bearer <preview_token>' http://<server>/api/v1/albums/<album_id>/cover/<resolution>. Compare responses between authorized and unauthorized requests.

Impact Analysis

An attacker with a valid preview token could enumerate and download album cover images belonging to other users. This could lead to unauthorized access to private photos, potential privacy breaches, and exposure of sensitive information if album covers contain identifiable or confidential visual data.

Compliance Impact

This vulnerability could violate privacy regulations like GDPR and HIPAA by allowing unauthorized access to personal or sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, reputational damage, and loss of user trust.

Mitigation Strategies

Update PhotoPrism to the latest version to apply security patches. Restrict access to the AlbumCover endpoint by implementing proper authorization checks. Review and rotate all preview tokens to invalidate potential attacker access. Monitor logs for suspicious activity and consider disabling the preview token feature if not essential.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72540. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart