CVE-2026-72540: PhotoPrism PhotoPrism - Insecure Direct Object Reference

Q: What is the severity of CVE-2026-72540?

The severity of CVE-2026-72540 is rated as medium with a score of 4.3.

Q: How do I fix CVE-2026-72540?

To fix CVE-2026-72540, ensure that the AlbumCover handler includes proper authorization checks before allowing access to album cover photos.

Q: What is the risk associated with CVE-2026-72540?

The risk associated with CVE-2026-72540 is categorized as a risk level of 22, indicating potential exposure due to unauthorized access.

Q: What type of vulnerability is CVE-2026-72540?

CVE-2026-72540 is classified as an insecure direct object reference vulnerability.

Q: When was CVE-2026-72540 published?

CVE-2026-72540 was published on August 11, 2026.

Published Aug 11, 2026

Updated

An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified album before serving the cover image. An attacker with any valid preview token can enumerate and download album cover images belonging to other users.

Affected Software

1 affected component

PhotoPrism<bb0b933

Event History

Aug 11, 2026

CVE Published

via MITRE·11:08 AM

Data Sourced

via MITRE·11:08 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72540?

The severity of CVE-2026-72540 is rated as medium with a score of 4.3.

How do I fix CVE-2026-72540?

To fix CVE-2026-72540, ensure that the AlbumCover handler includes proper authorization checks before allowing access to album cover photos.

What is the risk associated with CVE-2026-72540?

The risk associated with CVE-2026-72540 is categorized as a risk level of 22, indicating potential exposure due to unauthorized access.

What type of vulnerability is CVE-2026-72540?

CVE-2026-72540 is classified as an insecure direct object reference vulnerability.

When was CVE-2026-72540 published?

CVE-2026-72540 was published on August 11, 2026.

CVE-2026-72540: PhotoPrism PhotoPrism - Insecure Direct Object Reference

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-72540?

How do I fix CVE-2026-72540?

What is the risk associated with CVE-2026-72540?

What type of vulnerability is CVE-2026-72540?

When was CVE-2026-72540 published?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-72540?

How do I fix CVE-2026-72540?

What is the risk associated with CVE-2026-72540?

What type of vulnerability is CVE-2026-72540?

When was CVE-2026-72540 published?