CVE-2026-82985

The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...

CVE-2026-82985

The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...

EUVD-2026-82622

The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...

CVE-2026-82985

CVE-2026-82985 affects the Photos app 's filter-based smart albums . The root cause is that when a smart album is shared, the file listing is built using the viewer's photosSourceFolders search configuration rather than the album owner's configuration. This allows a user viewing a shared smart al...

Nextcloud: Shared smart albums in the Photos app can expose files outside the album owner's configured source folders

A vulnerability was discovered in a file manager component of a file sharing application. The vulnerability allowed an attacker to access files outside of the intended shared folder by configuring more permissive search paths than the victim intended. This resulted in unauthorized information...