CVE-2026-27833

Description

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

PUBLISHED Reserved 2026-02-24 | Published 2026-04-03 | Updated 2026-04-06 | Assigner GitHub_M

Problem types

CWE-862: Missing Authorization

Product status

References

github.com/...Piwigo/security/advisories/GHSA-397m-gfhm-pmg2

github.com/...ommit/d05c16561ce3692ca922199f8c8d7b1a45893f1c

piwigo.org/release-16.3.0

cve.org (CVE-2026-27833)

nvd.nist.gov (CVE-2026-27833)

Download JSON