CVE-2026-27833

HIGH SEVERITY

CVSS Score & Metrics

Base Score

7.5 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N                                    

Vulnerability Description

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

Vulnerability Details

Published Date

April 03, 2026

Last Modified

April 09, 2026

CWE ID

CWE-862

Source

NVD

Vendor

Piwigo

Product

Piwigo

External References

https://github.com/Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1c
https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2
https://piwigo.org/release-16.3.0

CVE-2026-27833

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment