CVE-2026-27833

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1c	Patch
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2	Exploit Vendor Advisory
https://piwigo.org/release-16.3.0	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-03 22:16

Updated : 2026-07-24 22:10

NVD link : CVE-2026-27833

Mitre link : CVE-2026-27833

CVE.ORG link : CVE-2026-27833

JSON object : View

Products Affected

piwigo

piwigo

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-27833", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27833", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T18:53:22.756623Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Piwigo", "product": "Piwigo", "versions": [{"status": "affected", "version": "< 16.3.0"}]}]}], "published": "2026-04-03T22:16:25.863", "references": [{"url": "https://github.com/Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://piwigo.org/release-16.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0."}, {"lang": "es", "value": "Piwigo es una aplicaci\u00f3n de galer\u00eda de fotos de c\u00f3digo abierto para la web. Antes de la versi\u00f3n 16.3.0, el m\u00e9todo API pwg.history.search en Piwigo est\u00e1 registrado sin la opci\u00f3n admin_only, permitiendo a usuarios no autenticados acceder al historial de navegaci\u00f3n completo de todos los visitantes de la galer\u00eda. Este problema ha sido parcheado en la versi\u00f3n 16.3.0."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3502BA46-5475-47BC-BA8F-F9456A836F1A", "versionEndExcluding": "16.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}