CVE-2026-96271: Photoview through 2.4.0 Authorization Bypass via shareAlbum

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-09-24
Weakness: CWE-639

Description

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.

Affected products

Photoview: through 2.4.0

References

https://github.com/photoview/photoview
https://github.com/photoview/photoview/blob/81affea602401c2f0207d955919ddcc0670a9222/api/graphql/models/actions/share_token_actions.go#L64-L82
https://github.com/photoview/photoview/commit/20541762fe6d9e0ce363c3d4c55556e4ccdc57a2
https://github.com/photoview/photoview/issues/1494
https://www.vulncheck.com/advisories/photoview-through-2.4.0-authorization-bypass-via-sharealbum

Get alerted when CVE-2026-96271 or the next vulnerability affects your stack