CVE-2026-6566

MediumCVSS 4.3/10Last modified Jul 24, 2026

Description

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default).

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
May 20, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-656608.8Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over CVE-2026-656617.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-656625.5Out-of-bounds read in Windows GDI allows an authorized attacker to disclose information locally.CVE-2026-656638.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-656647.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-656658.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-6566710.0Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.CVE-2026-656688.8Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.CVE-2026-656699.6Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attaCVE-2026-65674.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 thCVE-2026-656717.8Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally.CVE-2026-656727.8Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally.
CVE-2026-6566: Medium severity, CVSS 4.3 | Vulnix