# CVE-2026-16645: Drupal PhotoSwipe authorization bypass in image gallery display

Source: https://junglewise.ai/threats/cve-2026-16645-drupal-photoswipe-authorization-bypass-in-image-gallery-display  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16645 · Severity: critical · CVSS 9.1 · Published 2026-08-25

The PhotoSwipe Drupal module is a popular image gallery and lightbox display plugin used on thousands of Drupal websites. The module failed to properly check access permissions when displaying images through its gallery formatter, potentially allowing unauthorized users to view images that should have been restricted. This affects primarily sites that rely on access controls to limit who can view specific images.

Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-16645 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16645 being exploited in the wild.

**How severe is CVE-2026-16645?** Critical severity, with a CVSS score of 9.1, published 25 August 2026.

**Which products and versions are affected?** Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery before 3.0.4 (Drupal 8); before 3.2.0 (Drupal 9/10); Packagist:Https://Packages.Drupal.Org/8 Drupal/Photoswipe ECOSYSTEM:introduced=0,fixed=3.2.0.

**Is there a fix for CVE-2026-16645?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Photoswipe: upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16645 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-16645?** Check whether you run Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery or Packagist:Https://Packages.Drupal.Org/8 Drupal/Photoswipe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Photoswipe: upgrade to 3.2.0 or later

## Technical details

This is an authorization bypass vulnerability in the PhotoSwipe module's image formatter implementation. The vulnerable component failed to sufficiently validate access permissions before displaying images through the photoswipe gallery display formatter in versions before 3.0.4 (Drupal 8) and 3.2.0 (Drupal 9/10). The vulnerability allows an authenticated or unauthenticated attacker to forcefully browse and access images that should be protected by site access control rules. The impact is mitigated on sites using photoswipe for public image galleries, but is critical for sites restricting image visibility. Patches are available in versions 3.0.4, 3.1.x (deprecated), and 3.2.0 or higher.

## Affected products

- Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery before 3.0.4 (Drupal 8); before 3.2.0 (Drupal 9/10)

## Identifiers

- CVE-2026-16645
- DRUPAL-CONTRIB-2026-088

## Timeline

- 2026-07-22: disclosed
- 2026-08-25: advisory

## References

- [https://www.drupal.org/project/photoswipe](https://www.drupal.org/project/photoswipe)
- [https://www.drupal.org/sa-contrib-2026-088](https://www.drupal.org/sa-contrib-2026-088)

## Related threats

- [Drupal PhotoSwipe dynamic caption cross-site scripting](https://junglewise.ai/threats/cve-2026-84919-drupal-contrib-2026-131-this-module-enables-you-to-add-dynamic)