CVE-2026-104079
Received Received - Intake

Envira Gallery Lite Missing Authorization Flaw

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: VulnCheck

Description
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-104079
EUVD
EUVD-2026-95769

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Syed Balkhi Envira Gallery 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104079 is a missing authorization vulnerability in Envira Gallery Lite versions before 1.16.2. It allows lower-privileged authenticated users to create and publish galleries without proper permissions. The flaw exists because the gallery conversion REST endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can exploit this by supplying arbitrary image IDs without ownership verification to publish unauthorized content.

Detection Guidance

Check if Envira Gallery Lite versions before 1.16.2 are installed. Review WordPress REST API logs for unauthorized gallery creation or publishing actions. Inspect user activity logs for lower-privileged users performing actions beyond their permissions.

Impact Analysis

This vulnerability allows unauthorized users to create and publish galleries using images they do not own. It could lead to unauthorized content being displayed on your site, potential data leaks, or misuse of your gallery system. The impact is limited to authenticated users with lower privileges but could disrupt normal operations.

Mitigation Strategies

Update Envira Gallery Lite to version 1.16.2 or later immediately. Review and restrict user roles with edit permissions to prevent unauthorized gallery creation. Monitor published galleries for unauthorized content and remove any suspicious items.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104079. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart