CVE-2026-96271

HighCVSS 7.1/10Last modified Sep 24, 2026

Description

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-962727.5ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passeCVE-2026-962735.5Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException CVE-2026-962747.4In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that containCVE-2026-962758.8A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extracCVE-2026-962766.5If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writablCVE-2026-962778.7Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache TCVE-2026-962787.2The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions upCVE-2026-962796.5A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak applicatiCVE-2026-96288.8A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is an unknown function of the file /goform/formPptpClientConCVE-2026-962807.5The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit syCVE-2026-962816.2On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing CVE-2026-962823.1A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host direc