CVE-2026-96271

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-96271
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96271.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-96271
Published
2026-09-23T00:29:49Z
Modified
2026-09-24T03:47:44Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Photoview through 2.4.0 Authorization Bypass via shareAlbum
Details

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96271.json"
}
References

Affected packages

Git / github.com/photoview/photoview

Affected ranges

Type
GIT
Repo
https://github.com/photoview/photoview
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f79d379e38241c687c55e9f899e30661fd9f115a
Fixed
20541762fe6d9e0ce363c3d4c55556e4ccdc57a2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.4.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v2.*
v2.0.0
v2.0.1
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96271.json"