18 matches found
PhotoPrism StartIndexing path traversal (index endpoint escapes the originals directory)
PhotoPrism StartIndexing path traversal index endpoint escapes the originals directory Vulnerability Overview PhotoPrism's indexing feature allows specifying the subdirectory to scan via the path parameter of POST /api/v1/index. Before the fix, when this path was joined with the media library roo...
PhotoPrism global preview/download tokens bypass resource visibility boundaries
PhotoPrism global preview/download tokens bypass resource visibility boundaries Vulnerability Overview PhotoPrism loads thumbnails and file downloads via simple URLs that cannot carry authentication headers preview/download tokens in query parameters or paths, validated by an in-memory token look...
PhotoPrism WebDAV Sync path traversal allows writing to arbitrary paths
PhotoPrism WebDAV Sync path traversal allows writing to arbitrary paths Vulnerability Overview PhotoPrism supports WebDAV sync: after an administrator configures a WebDAV remote, a background worker pulls the remote directory listing and downloads files to the local sync directory. The local...
PhotoPrism Vision API can read server-local files
PhotoPrism Vision API can read server-local files Vulnerability Overview PhotoPrism's computer vision features caption, labels, nsfw, face assemble image references into outbound requests to the configured vision model through a set of request builders. Image references come from two sources: loc...
CVE-2026-72540
Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...
CVE-2026-72540
Red Hat CNA-LR concluded that this CVE is not valid...
CVE-2026-72540
This CVE was rejected by Red Hat CNA-LR as not valid. However, EUVD and PT Security describe an insecure direct object reference (IDOR) in PhotoPrism through commit bb0b933. The AlbumCover handler does not verify that the requesting user is authorized to access the specified album before serving ...
CVE-2026-72540
...
EUVD-2026-56010
An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified alb...
PT-2026-70115
An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified alb...
CVE-2026-57945
PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PU...
CVE-2026-57945 PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint
PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PU...
CVE-2026-57945
Summary of CVE-2026-57945 (PhotoPrism) : A broken access control flaw in PhotoPrism prior to 260601-a7d098548 allows authenticated non-admin users to modify other users’ profile information by exploiting the PUT /api/v1/users/{uid} endpoint. The root cause is missing validation that ties the sess...
CVE-2026-57945 PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint
PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PU...
EUVD-2026-40162
PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PU...
CVE-2026-57945: Authorization Bypass Through User-Controlled Key
PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PU...
PT-2026-53663
PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PU...