CVE-2026-82985: Medium severity vulnerability
The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched — allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album.
This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be a user with whom the album owner has shared a filter-based smart album. The issue does not provide access to arbitrary users' files without such a share.
What information could be exposed?
The recipient may discover files in the album owner's folders that were not intended to be included in the shared album. Exposed information includes file names, file IDs, and other metadata.
Why does the shared album include unintended files?
The smart album evaluates its file listing using the viewing user's photosSourceFolders search configuration rather than the album owner's configuration. This can cause the owner's files in folders outside the owner's intended album scope to be searched and surfaced.