CVE-2026-57945: PhotoPrism Auth Bypass Vulnerability

CVE-2026-57945 Overview

CVE-2026-57945 is a broken access control vulnerability in PhotoPrism versions before 260601-a7d098548. The flaw resides in the PUT /api/v1/users/:uid endpoint, which fails to validate that the authenticated session identifier matches the target user identifier in the request path. Authenticated non-admin users can modify arbitrary user profile information by sending requests to other users' endpoints. The weakness maps to CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated PhotoPrism user can overwrite another user's profile details, including administrators, enabling account tampering and potential lateral movement within a multi-user PhotoPrism instance.

Affected Products

PhotoPrism versions prior to build 260601-a7d098548
Self-hosted PhotoPrism deployments with multiple user accounts
PhotoPrism instances exposing the REST API to authenticated non-admin users

Discovery Timeline

2026-06-29 - CVE-2026-57945 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-57945

Vulnerability Analysis

PhotoPrism exposes a REST API that allows users to manage their own profile information through the PUT /api/v1/users/:uid endpoint. The endpoint accepts a user identifier (uid) in the URL path and applies the submitted changes to the user record matching that identifier. The handler authenticates the requester but does not verify that the session-bound user identifier matches the uid supplied in the path. As a result, a low-privileged authenticated user can substitute another user's identifier and update fields on that account.

Because the endpoint accepts a network-based request with only low privileges required, exploitation is straightforward and requires no user interaction. Successful attacks change profile attributes on the targeted account, which can disrupt legitimate access or facilitate follow-on abuse in shared deployments.

Root Cause

The underlying defect is missing object-level authorization. The API controller trusts the path parameter as the target user without cross-checking it against the authenticated session subject. This is a classic Insecure Direct Object Reference pattern classified under CWE-639.

Attack Vector

An attacker first authenticates to PhotoPrism with any valid non-admin account. The attacker then issues an HTTP PUT request to /api/v1/users/{victim_uid} with a JSON body containing the profile fields to overwrite. The server applies the changes to the victim account. Detailed technical context is available in the VulnCheck Security Advisory and the GitHub Issue Report.

Detection Methods for CVE-2026-57945

Indicators of Compromise

HTTP PUT requests to /api/v1/users/:uid where the :uid path parameter does not match the authenticated session's user identifier.
Unexpected modifications to user profile fields (display name, email, preferences) without corresponding admin activity.
Audit log entries showing profile changes on accounts by unrelated session actors.

Detection Strategies

Ingest PhotoPrism access logs into a centralized SIEM and correlate the session user identifier with the target uid in each PUT request.
Alert on any PUT request to /api/v1/users/:uid originating from a non-admin session against a different user identifier.
Baseline normal user-profile update patterns and flag deviations, particularly requests targeting administrator accounts.

Monitoring Recommendations

Enable verbose API access logging on the PhotoPrism reverse proxy or ingress layer to capture request paths, methods, and authenticated principals.
Monitor the users database table for profile field changes and cross-reference them with authenticated API activity.
Track authentication logs for accounts whose profiles change shortly after a non-admin login from an unexpected source.

How to Mitigate CVE-2026-57945

Immediate Actions Required

Upgrade PhotoPrism to build 260601-a7d098548 or later, as documented in the GitHub Release Notes.
Audit all user accounts for unauthorized profile modifications and restore known-good values where tampering is confirmed.
Rotate credentials and re-verify administrator account details on any instance that ran a vulnerable build with multiple users.

Patch Information

The PhotoPrism maintainers fixed the missing authorization check in build 260601-a7d098548. The updated handler validates that the authenticated session identifier matches the uid path parameter before applying changes, unless the caller has administrator privileges. Refer to the GitHub Release Notes for the exact commit and upgrade instructions.

Workarounds

Restrict the PhotoPrism API to trusted networks using a reverse proxy access control list until the patch is deployed.
Temporarily disable non-admin accounts on multi-user instances, or run PhotoPrism as a single-user deployment until upgrade.
Add a reverse-proxy rule that blocks PUT requests to /api/v1/users/:uid when the requesting session does not correspond to the target uid.

bash

# Example NGINX rule to block PUT requests to the vulnerable endpoint
# until PhotoPrism is upgraded to build 260601-a7d098548 or later.
location ~ ^/api/v1/users/[^/]+$ {
    if ($request_method = PUT) {
        return 403;
    }
    proxy_pass http://photoprism_backend;
}