CVE-2026-27833

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-27833

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27833.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-27833

Aliases

GHSA-397m-gfhm-pmg2

Published

2026-04-03T21:34:11.425Z

Modified

2026-08-07T11:50:43.480236221Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Piwigo: Unauthenticated Information Disclosure via pwg.history.search API

Details

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27833.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/piwigo/piwigo

Affected ranges

Type

GIT

Repo

https://github.com/piwigo/piwigo

Events

Introduced

Fixed

69f1f76192e6e692f575a5f79c194655dee2d5ca

Fixed

d05c16561ce3692ca922199f8c8d7b1a45893f1c

Database specific

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.3.0"
        }
    ]
}

Affected versions

12.*

12.0.0RC1

12.0.0RC2

12.0.0beta1

12.0.0beta2

13.*

13.0.0RC1

13.0.0RC2

13.0.0RC3

13.0.0RC4

13.0.0beta1

13.0.0beta2

14.*

14.0.0RC1

14.0.0RC2

14.0.0beta1

14.0.0beta2

14.0.0beta3

15.*

15.0.0beta1

15.0.0beta2

15.0.0beta3

16.*

16.0.0

16.0.0RC1

16.0.0RC2

16.0.0RC3

16.0.0beta1

16.0.0beta2

16.1.0

16.2.0

2.*

2.10.0RC1

2.10.0beta1

2.10.0beta2

2.11.0beta1

2.11.0beta2

2.11.0beta3

2.11.0beta4

2.8.0RC1

2.8.0RC2

2.9.0RC1

2.9.0RC2

2.9.0beta1

2.9.0beta2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27833.json"