CVE-2026-96271

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

CVE-2026-96271

Photoview through version 2.4.0 is affected by an authorization bypass vulnerability within the shareAlbum GraphQL mutation . This flaw allows authenticated users to generate functional share tokens for albums owned by other users by supplying arbitrary album IDs. Consequently, attackers can expo...

EUVD-2026-84990

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

CVE-2026-96271 Photoview through 2.4.0 Authorization Bypass via shareAlbum

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

CVE-2026-96271 Photoview through 2.4.0 Authorization Bypass via shareAlbum

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

CVE-2026-96271 Photoview through 2.4.0 Authorization Bypass via shareAlbum

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

CVE-2026-96271: Authorization Bypass Through User-Controlled Key

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

PT-2026-97122

Name of the Vulnerable Software and Affected Versions Photoview versions prior to 2.4.1 Description An authorization bypass exists in the shareAlbum GraphQL mutation. This flaw allows authenticated users to generate share tokens for albums they do not own by providing arbitrary album IDs...