Photoview CVE-2026-96271

Requires an authenticated low-privileged account on a multi-user Photoview instance (PR:L) - this is the primary limiting factor, so single-user/private deployments are not meaningfully at risk. Given a valid session, the attacker invokes the shareAlbum GraphQL mutation and supplies an album ID owned by another user; because AddAlbumShare (share_token_actions.go) did not scope the lookup to the caller's albums, any valid album ID yields a working share token. No user interaction, no special non-default configuration, and no elevated privileges are needed beyond ordinary login; album IDs are sequential integers making target enumeration trivial. Exposure of the leaked content additionally requires the attacker to distribute the generated share link, but token generation and control are fully attacker-driven.

This is a genuine authorization/IDOR flaw (CWE-639) with a coherent, verifiable signal chain rather than an inflated high-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N = 7.1) is well-supported: exploitation is network-reachable, low-complexity, requires only a low-privileged authenticated account, and needs no user interaction, with high confidentiality impact (exposure of arbitrary victims' photos and sub-albums) and low integrity impact (attacker-controlled share-token creation). The fix commit (20541762) confirms the root cause precisely - AddAlbumShare failed to scope the query to the requesting user's albums - so the technical claim is corroborated by source-code evidence, not just the description. No EPSS score, no CISA KEV listing, and no public weaponized exploit code were provided, so despite the moderately high CVSS this is not evidence of active exploitation. The vendor has shipped a patch and VulnCheck published an advisory, but there is no signal (KEV/EPSS/POC) that mass exploitation is occurring; realistically this is a targeted-abuse risk against exposed multi-user Photoview instances rather than an internet-wide threat. Note the input Tag 'Authentication Bypass' is imprecise: this is an authorization/access-control failure (authenticated users escalating access to others' resources), not an authentication bypass.

An attacker registers or already holds a low-privileged account on a shared Photoview instance, then calls the shareAlbum GraphQL mutation supplying album IDs they do not own (album IDs are sequential integers, easily enumerated). The server returns a valid share token, and the attacker distributes the resulting share link to expose another user's private photos and sub-albums, retaining indefinite control over the token's settings. No public proof-of-concept exploit was identified, but the vendor's regression test in the patch demonstrates the exact non-owner exploitation path.