CVE-2026-96271: Photoview through 2.4.0 Authorization Bypass via shareAlbum
Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Photoview and have permission to invoke the shareAlbum GraphQL mutation. No user interaction is required.
What information does an attacker need?
The attacker needs an album ID for an album owned by another user. They can supply that ID to create a working share token for the victim album.
What data can be exposed through an unauthorized share link?
The generated link can expose photos and sub-albums in the targeted victim album to anyone who receives the link.
Does the attacker retain access after creating the link?
Yes. The attacker retains indefinite control over the share token's settings.
Which versions are known to be affected?
Photoview through version 2.4.0 is affected.