CVE-2026-96271: Photoview Authorization Bypass Vulnerability

CVE-2026-96271 Overview

CVE-2026-96271 is an authorization bypass vulnerability in Photoview through version 2.4.0. The flaw resides in the shareAlbum GraphQL mutation, where the ownership check fails to scope validation to the requested album ID. Any authenticated user can supply an arbitrary album ID belonging to another user and receive a valid share token in response. The generated token exposes the victim's photos and sub-albums to anyone holding the link. The attacker also retains indefinite control over token settings, including expiration and password protection [CWE-639].

Critical Impact
Authenticated Photoview users can create working share links for albums owned by other users, exposing private photo collections and sub-albums to arbitrary third parties.

Affected Products

Photoview through version 2.4.0
Photoview GraphQL API shareAlbum mutation
Photoview self-hosted deployments exposing multi-user accounts

Discovery Timeline

2026-09-23 - CVE-2026-96271 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96271

Vulnerability Analysis

Photoview is a self-hosted photo gallery application written in Go with a GraphQL API. The shareAlbum mutation is intended to let a user create a share token for an album they own. The mutation delegates ownership verification to the AddAlbumShare helper in api/graphql/models/actions/share_token_actions.go. The vulnerable query counts rows in the user_albums join table where the calling user has any album association, without constraining the query to the album ID supplied by the caller. The count therefore returns a non-zero value for any authenticated user who owns at least one album. The mutation then proceeds to create a share token bound to the attacker-supplied album ID.

Root Cause

The root cause is a missing predicate in the GORM query that verifies album ownership. The Where clause filters user_albums by user_id but never constrains albums.id to the requested album. This is a classic Insecure Direct Object Reference pattern [CWE-639] where an authorization check exists but is scoped incorrectly.

Attack Vector

An authenticated user issues a shareAlbum GraphQL mutation with an albumID value that belongs to another Photoview user. The server returns a valid share token. The attacker then distributes the resulting share URL to view or download the victim's photos and sub-albums.

// Vulnerable code path in api/graphql/models/actions/share_token_actions.go
// The patch (commit 20541762) adds the missing album scoping predicate.
var count int64
err := db.
	Model(&models.Album{}).
+	Where("albums.id = ?", albumID).
	Where("EXISTS (SELECT * FROM user_albums WHERE user_albums.album_id = albums.id AND user_albums.user_id = ?)",
		user.ID).
	Count(&count).Error

Source: GitHub Commit 20541762. The added Where("albums.id = ?", albumID) predicate scopes the ownership check to the specific album requested by the caller.

Detection Methods for CVE-2026-96271

Indicators of Compromise

Unexpected share_tokens database rows referencing albums whose owner_id does not match the creating user.
GraphQL request logs showing shareAlbum mutations issued by low-privilege users against album IDs outside their owned set.
Access log entries for /share/<token> paths tied to tokens generated by non-owning accounts.

Detection Strategies

Audit the share_tokens table by joining against user_albums and flagging any token whose user_id (creator) has no ownership relationship to the target album_id.
Enable GraphQL query logging in the Photoview API and alert on shareAlbum mutations where the resolver-provided user identity differs from the album owner.
Correlate authentication events with share token creation to identify accounts issuing an anomalous number of shareAlbum calls.

Monitoring Recommendations

Forward Photoview API logs and reverse-proxy access logs to a centralized log platform for anomaly analysis on shareAlbum operations.
Monitor outbound traffic patterns on share URLs to identify large-scale enumeration or exfiltration of shared media.
Track new share token creation velocity per user account and alert on deviations from baseline sharing behavior.

How to Mitigate CVE-2026-96271

Immediate Actions Required

Upgrade Photoview to a release that includes commit 20541762fe6d9e0ce363c3d4c55556e4ccdc57a2, which scopes the AddAlbumShare ownership check to the requested album.
Revoke all existing album share tokens and require owners to regenerate legitimate share links after patching.
Restrict Photoview account registration and audit existing accounts to remove untrusted users while the patch is being deployed.

Patch Information

The fix is available in the Photoview repository as commit 20541762fe6d9e0ce363c3d4c55556e4ccdc57a2, referenced by GitHub Issue #1494 and detailed in the VulnCheck Advisory. Deploy a build containing this commit or any Photoview release published after 2.4.0 that incorporates the change.

Workarounds

Place Photoview behind a reverse proxy that blocks the shareAlbum GraphQL operation until the patched build is deployed.
Disable public share link resolution at the reverse proxy layer by returning HTTP 403 for /share/* routes during the mitigation window.
Purge existing rows from the share_tokens table to invalidate tokens that may already have been generated by an attacker.

bash

# Invalidate all existing album share tokens after patching
# Adjust credentials and database name for your Photoview deployment
mysql -u photoview -p photoview -e "DELETE FROM share_tokens WHERE album_id IS NOT NULL;"