Executive brief
Photoview is a self-hosted photo gallery application. An authenticated attacker can exploit an authorization flaw in the shareAlbum GraphQL mutation to create share links for photo albums owned by other users, exposing private photos and sub-albums to anyone with the link while maintaining control over share settings indefinitely.
Technical details
The shareAlbum GraphQL mutation fails to verify that the authenticated user owns the target album before generating a share token. An attacker can supply arbitrary album IDs to create valid share links for victim albums. This requires prior authentication but no further user interaction; once a share token is generated, it grants persistent access to the album without expiration restrictions.
Affected products
- Photoview Photoview through 2.4.0
Timeline
- 2026-09-23: disclosed