CVE-2026-96271
Received Received - Intake

Authorization Bypass in Photoview via ShareAlbum GraphQL Mutation

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulnCheck

Description
Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96271
EUVD
EUVD-2026-84990

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
photoview photoview to 2.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96271 is an authorization bypass vulnerability in Photoview through version 2.4.0. It affects the shareAlbum GraphQL mutation, allowing authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate valid share tokens for victim albums, exposing photos and sub-albums to anyone with the link. The attacker retains control over token settings indefinitely.

Detection Guidance

To detect this vulnerability, check for unauthorized share links in Photoview by inspecting GraphQL mutations for shareAlbum requests with arbitrary album IDs. Review logs for users generating share tokens without ownership of the target album. Use database queries to find share tokens linked to albums not owned by the requesting user.

Impact Analysis

If you use Photoview, an attacker with an account could access your private albums by generating share tokens for them. This exposes your photos and sub-albums to unauthorized users via share links. Even if you remove the share link, the attacker can recreate it with modified settings, maintaining access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating privacy requirements in GDPR and HIPAA. Exposure of personal or health-related photos may result in non-compliance, potential data breaches, and legal consequences for organizations handling regulated data.

Mitigation Strategies

Immediately update Photoview to the latest patched version that includes the fix for the AddAlbumShare function. If updating is not possible, disable the shareAlbum GraphQL mutation or restrict access to authenticated users with strict ownership validation. Monitor for unauthorized share links and revoke any suspicious tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart