EUVD-2026-66202
GHSA-wq7x-7x4j-792v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote, unauthenticated, low-complexity forceful browsing exposes restricted content (C:H); a missing read authorization does not modify data (I:N) or affect availability (A:N), diverging from NVD's I:H.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.
AnalysisAI
Missing authorization in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery contributed module (all versions from 0.0.0 up to and including 3.2.0) lets unauthenticated remote users reach gallery resources they should not be able to see by directly requesting their URLs (forceful browsing). Because the module fails to enforce access control on protected content, an attacker can enumerate and retrieve images or associated data intended for privileged users only. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a Drupal site has the vulnerable PhotoSwipe module (0.0.0 through 3.2.0) installed and serving galleries whose underlying resources are meant to be access-restricted; the attacker must be able to reach the site over the network and know or enumerate the resource URLs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and should be weighed rather than taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the PhotoSwipe module to the fixed release identified in Drupal advisory SA-CONTRIB-2026-088 (https://www.drupal.org/sa-contrib-2026-088); a patch is available per the vendor, though the exact fixed version string is not included in the provided data, so confirm the target release on the advisory page before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Drupal installations using the PhotoSwipe module and identify which versions (0.0.0-3.2.0) are deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today