Photoswipe Responsive Javascript Modal Image Gallery
Monthly
Missing authorization in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery contributed module (all versions from 0.0.0 up to and including 3.2.0) lets unauthenticated remote users reach gallery resources they should not be able to see by directly requesting their URLs (forceful browsing). Because the module fails to enforce access control on protected content, an attacker can enumerate and retrieve images or associated data intended for privileged users only. No public exploit identified at time of analysis, and EPSS is low (0.13%), but the flaw is trivially automatable per CISA SSVC.
Missing authorization in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery contributed module (all versions from 0.0.0 up to and including 3.2.0) lets unauthenticated remote users reach gallery resources they should not be able to see by directly requesting their URLs (forceful browsing). Because the module fails to enforce access control on protected content, an attacker can enumerate and retrieve images or associated data intended for privileged users only. No public exploit identified at time of analysis, and EPSS is low (0.13%), but the flaw is trivially automatable per CISA SSVC.