CVE-2026-16645: Drupal PhotoSwipe Auth Bypass Vulnerability

CVE-2026-16645 Overview

CVE-2026-16645 is a missing authorization vulnerability in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery module. The flaw affects all versions from 0.0.0 through 3.2.0 and allows unauthenticated attackers to reach restricted resources through forceful browsing. The weakness maps to CWE-862: Missing Authorization.

An attacker can send crafted HTTP requests over the network to access image gallery resources without authenticating or holding the expected privileges. Successful exploitation exposes confidential content and permits modification of protected data managed by the module.

Critical Impact
Unauthenticated network attackers can bypass access controls to read and modify PhotoSwipe gallery resources on affected Drupal sites.

Affected Products

Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery module, versions 0.0.0 through 3.2.0
Drupal sites with the PhotoSwipe contributed module enabled
Any deployment relying on PhotoSwipe module access controls to gate gallery resources

Discovery Timeline

2026-08-25 - CVE-2026-16645 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-16645

Vulnerability Analysis

The PhotoSwipe module exposes routes or endpoints that render or serve gallery content without performing the authorization checks required by the Drupal permission system. Because authorization is missing, the application processes requests based on the URL or resource identifier rather than the caller's granted permissions.

An unauthenticated attacker can enumerate or guess resource identifiers and retrieve content that should be gated by role-based permissions. The vulnerability is classified as forceful browsing, meaning the attacker directly requests hidden or unlinked resources instead of navigating through the intended UI flow.

Because the CVSS vector indicates confidentiality and integrity impact, the flaw enables both disclosure of protected media and manipulation of module-managed data. No user interaction is required, and the attack complexity is low.

Root Cause

The root cause is an absent or incomplete authorization check on module-provided routes and controllers. Drupal modules must declare _permission or _access requirements on routes and enforce them in controllers, and PhotoSwipe releases up to 3.2.0 fail to consistently apply these checks. Review the Drupal Security Advisory SA-CONTRIB-2026-088 for details on impacted code paths.

Attack Vector

Exploitation occurs over the network with a standard HTTP client. An attacker crafts requests to module endpoints referencing gallery resources or configuration and receives responses that should require authentication. No credentials, tokens, or user interaction are needed to trigger the missing check.

No verified public exploit or proof-of-concept has been published at the time of writing. The EPSS probability remains low, but the unauthenticated network reachability makes opportunistic scanning likely once details circulate.

Detection Methods for CVE-2026-16645

Indicators of Compromise

Anonymous HTTP requests to PhotoSwipe module paths returning 200 OK for resources that should require authentication
Unusual enumeration patterns against gallery or media identifiers in Drupal access logs
Access to administrative or configuration endpoints of the PhotoSwipe module from external IP addresses

Detection Strategies

Audit Drupal watchdog and web server logs for anonymous access to PhotoSwipe routes, correlating source IPs against known user sessions
Compare the module version installed on each Drupal site against the fixed release using drush pm:list or the Drupal admin reports page
Baseline normal traffic to gallery endpoints and alert on request volume spikes from single sources indicative of forceful browsing

Monitoring Recommendations

Forward Drupal access logs and web server logs to a centralized analytics platform for anomaly detection
Enable Drupal's built-in logging for permission denials and monitor for missing entries where denials would be expected
Deploy web application firewall rules that flag unauthenticated requests to module administrative paths

How to Mitigate CVE-2026-16645

Immediate Actions Required

Inventory all Drupal sites running the PhotoSwipe module and identify versions at or below 3.2.0
Update the PhotoSwipe module to the patched release referenced in SA-CONTRIB-2026-088
Restrict network access to Drupal administrative and module endpoints while patching is in progress
Review access and application logs for evidence of unauthorized retrieval of gallery resources

Patch Information

Drupal has published guidance in the Drupal Security Advisory SA-CONTRIB-2026-088. Site operators should upgrade the PhotoSwipe module to the fixed version indicated in that advisory. After upgrading, clear the Drupal cache and rebuild the routing table so the corrected access checks take effect.

Workarounds

Disable and uninstall the PhotoSwipe module until the patched release can be deployed
Place affected module paths behind additional authentication at the reverse proxy or web server layer
Apply a web application firewall rule to block anonymous requests to PhotoSwipe endpoints until remediation is complete

bash

# Configuration example
# Update the PhotoSwipe module using Composer and Drush, then clear caches
composer update drupal/photoswipe --with-dependencies
drush updatedb -y
drush cache:rebuild
drush pm:list --status=enabled | grep photoswipe