Is CVE-2026-27833 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27833 being exploited in the wild.

How severe is CVE-2026-27833?

High severity, with a CVSS score of 7.5, published 3 April 2026.

Is there a fix for CVE-2026-27833?

A patch was published on 2026-02-24: Version 16.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27833 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-27833?

Check whether you run Piwigo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27833: Piwigo missing authorization in pwg.history.search API

CVE-2026-27833 · Severity: high · CVSS 7.5 · Published 2026-04-03

Piwigo is an open-source photo gallery application used to manage and display image collections online. A security flaw allows anyone on the internet to access the private browsing history of all gallery visitors without needing a password. This could lead to the exposure of visitor IP addresses, usernames, and details about which specific images were viewed or downloaded.

Technologies: Piwigo. Vendors: Piwigo.

Quick answers

Is CVE-2026-27833 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27833 being exploited in the wild.
How severe is CVE-2026-27833?: High severity, with a CVSS score of 7.5, published 3 April 2026.
Which products and versions are affected?: Piwigo < 16.3.0.
Is there a fix for CVE-2026-27833?: A patch was published on 2026-02-24: Version 16.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27833 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-27833?: Check whether you run Piwigo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) exists in the Piwigo web API. The 'pwg.history.search' method in 'ws.php' was registered without the 'admin_only' flag, and the corresponding handler function 'ws_history_search()' in 'include/ws_functions/pwg.php' lacked manual authentication checks. An unauthenticated remote attacker can exploit this by sending a crafted HTTP request to the API to retrieve sensitive information, including visitor IP addresses, user IDs, image viewing/download history, and search queries. The vulnerability is resolved in version 16.3.0 by properly enforcing administrative restrictions on the affected API endpoint.

Affected products

Piwigo Piwigo < 16.3.0

Timeline

2026-02-24: patched: Version 16.3.0 released
2026-04-01: advisory: GitHub Security Advisory published
2026-04-03: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.