# CVE-2026-27833: Piwigo missing authorization in pwg.history.search API

Source: https://junglewise.ai/threats/cve-2026-27833-piwigo-missing-authorization-in-pwg-history-search-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-27833 · Severity: high · CVSS 7.5 · Published 2026-04-03

Piwigo is an open-source photo gallery application used to manage and display image collections online. A security flaw allows anyone on the internet to access the private browsing history of all gallery visitors without needing a password. This could lead to the exposure of visitor IP addresses, usernames, and details about which specific images were viewed or downloaded.

Technologies: [Piwigo](https://junglewise.ai/threats/technologies/piwigo). Vendors: [Piwigo](https://junglewise.ai/threats/vendors/piwigo).

## Quick answers

**Is CVE-2026-27833 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27833 being exploited in the wild.

**How severe is CVE-2026-27833?** High severity, with a CVSS score of 7.5, published 3 April 2026.

**Which products and versions are affected?** Piwigo < 16.3.0.

**Is there a fix for CVE-2026-27833?** A patch was published on 2026-02-24: Version 16.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27833 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-27833?** Check whether you run Piwigo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization check (CWE-862) exists in the Piwigo web API. The 'pwg.history.search' method in 'ws.php' was registered without the 'admin_only' flag, and the corresponding handler function 'ws_history_search()' in 'include/ws_functions/pwg.php' lacked manual authentication checks. An unauthenticated remote attacker can exploit this by sending a crafted HTTP request to the API to retrieve sensitive information, including visitor IP addresses, user IDs, image viewing/download history, and search queries. The vulnerability is resolved in version 16.3.0 by properly enforcing administrative restrictions on the affected API endpoint.

## Affected products

- Piwigo Piwigo < 16.3.0

## Timeline

- 2026-02-24: patched: Version 16.3.0 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: CVE published to NVD

## References

- [https://github.com/Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1c](https://github.com/Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1c)
- [https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2](https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2)
- [https://piwigo.org/release-16.3.0](https://piwigo.org/release-16.3.0)

## Related threats

- [Piwigo SQL injection in image rating search](https://junglewise.ai/threats/cve-2026-62262-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection in upgrade authentication](https://junglewise.ai/threats/cve-2026-44642-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection via unvalidated image_order parameter](https://junglewise.ai/threats/cve-2026-42324-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo SQL injection in batch manager filter](https://junglewise.ai/threats/cve-2026-42323-piwigo-is-a-full-featured-open-source-photo-gallery-application)
- [Piwigo arbitrary code execution via logo upload extension validation bypass](https://junglewise.ai/threats/cve-2026-42322-piwigo-is-a-full-featured-open-source-photo-gallery-application)