---
id: CVE-2026-96271
title: >-
  Photoview through 2.4.0 contains an authorization bypass vulnerability in the
  shareAlbum GraphQL mutation that allows authenticated users to create share
  links for albums owned by other users
summary: >-
  Photoview through 2.4.0 contains an authorization bypass vulnerability in the
  shareAlbum GraphQL mutation that allows authenticated users to create share
  links for albums owned by other users. Attackers can supply arbitrary album
  IDs to …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-639
vendor: photoview
product: photoview
affected:
  - photoview <= 2.4.0
published: '2026-09-23'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:08:55.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96271'
references:
  - url: 'https://github.com/photoview/photoview'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/photoview/photoview/blob/81affea602401c2f0207d955919ddcc0670a9222/api/graphql/models/actions/share_token_actions.go#L64-L82
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/photoview/photoview/commit/20541762fe6d9e0ce363c3d4c55556e4ccdc57a2
    label: disclosure@vulncheck.com
  - url: 'https://github.com/photoview/photoview/issues/1494'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/photoview-through-2.4.0-authorization-bypass-via-sharealbum
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00227
epssPercentile: 0.11961
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-23T15:14:53.755232Z'
ingestedAt: '2026-09-23T01:14:44.488Z'
---

## Overview

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.