What is the CVSS score of CVE-2026-27833?

CVE-2026-27833 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Piwigo are affected by CVE-2026-27833?

Piwigo photo gallery versions prior to 16.3.0 contain an unauthenticated information disclosure vulnerability that exposes complete browsing history for all gallery visitors through an unprotected…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27833?

Yes, a public proof-of-concept exploit is available for CVE-2026-27833. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27833?

Within 24 hours: Identify all Piwigo instances in production and confirm current version numbers. Within 7 days: Upgrade all instances to Piwigo 16.3.0 or later per vendor advisory. Within 30 days: Audit logs to determine if pwg.history.search endpoint was accessed in the past 90 days and notify affected users if exposure is confirmed.

Piwigo CVE-2026-27833

EUVD-2026-18870 HIGH

Missing Authorization (CWE-862)

2026-04-03 GitHub_M

Authentication Bypass Piwigo

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.3.0

EUVD ID Assigned

Apr 03, 2026 - 22:15 euvd

EUVD-2026-18870

Analysis Generated

Apr 03, 2026 - 22:15 vuln.today

CVE Published

Apr 03, 2026 - 21:34 nvd

HIGH 7.5

DescriptionCVE.org

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

AnalysisAI

Unauthenticated information disclosure in Piwigo photo gallery software (versions prior to 16.3.0) allows remote attackers to retrieve complete browsing history of all gallery visitors through exposed pwg.history.search API endpoint. The API method lacks mandatory admin-only access controls (CWE-862), enabling trivial privacy violation with CVSS 7.5 severity. EPSS exploitation probability and KEV status not available; no public exploit identified at time of analysis, though exploitation requires only basic HTTP requests given the zero-authentication requirement (CVSS vector PR:N).

Technical ContextAI

Piwigo implements a web-based API for administrative functions, including pwg.history.search which queries visitor browsing history stored by the gallery application. The vulnerability stems from improper privilege management (CWE-862): the API endpoint registration failed to enforce the admin_only flag, bypassing Piwigo's role-based access control mechanism. As a result, the endpoint responds to anonymous requests without session validation or authentication tokens. The affected component is the core API routing layer in Piwigo's PHP codebase, specifically the method registration system that should enforce administrative privilege requirements for sensitive operations. The CPE identifier cpe:2.3:a:piwigo:piwigo targets the application vendor and product namespace, with version-specific scope detailed in affected products analysis.

RemediationAI

Upgrade immediately to Piwigo version 16.3.0 or later, which includes the vendor-released patch addressing the privilege management flaw. The fix implemented in commit d05c16561ce3692ca922199f8c8d7b1a45893f1c enforces admin_only access control on the pwg.history.search API method, preventing unauthenticated access. Download patched release from piwigo.org/release-16.3.0 and follow standard upgrade procedures documented in vendor migration guides. No effective workarounds exist short of disabling visitor history tracking entirely or implementing reverse proxy authentication rules to block /ws.php API access from untrusted networks. For environments unable to upgrade immediately, restrict network access to administrative interfaces via firewall rules permitting only trusted IP ranges. Post-upgrade, review server logs for suspicious pwg.history.search queries from unauthenticated sources to identify potential prior exploitation. Vendor advisory reference: https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2