Drupal PhotoSwipe CVE-2026-16645

Exploitation requires only that a Drupal site has the vulnerable PhotoSwipe module (0.0.0 through 3.2.0) installed and serving galleries whose underlying resources are meant to be access-restricted; the attacker must be able to reach the site over the network and know or enumerate the resource URLs. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed. Limiting factors: the target must actually run this contrib module and host content that is supposed to be protected - sites where all gallery content is public gain nothing for an attacker; the impact is bounded to whatever the exposed resources contain, and the flaw does not by itself grant code execution or account access.

Signals are mixed and should be weighed rather than taken at face value. The NVD CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), driven by remote, unauthenticated, low-complexity access with High confidentiality AND integrity impact; however, for a missing-authorization/forceful-browsing read-access flaw on a gallery module the I:H rating looks generous, and an independent assessment would more likely rate integrity as None - verify with the vendor advisory. SSVC frames it as Exploitation: none (no observed exploitation), Automatable: yes (discovery/exploitation can be scripted), Technical Impact: total. EPSS is low at 0.13% (3rd percentile), and it is not on CISA KEV, so there is no evidence of active exploitation despite the high CVSS. Net: this is a real, easy-to-exploit access-control gap on affected sites and worth patching promptly, but it is not a widespread emergency - treat it as a prompt-patch item, prioritized higher where the galleries hold sensitive or restricted images.

An attacker browsing a Drupal site that uses PhotoSwipe guesses or enumerates the direct URL of a gallery resource that should require permission, requests it without logging in, and receives the restricted image or data because no authorization check is performed. Because CVSS is AV:N/AC:L/PR:N/UI:N and SSVC marks it automatable, the attacker can script bulk enumeration across many resource IDs. No public proof-of-concept is identified at time of analysis.