PT-2026-30242 · Piwigo · Piwigo

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-27833

NVD

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-27833

Affected Products

Piwigo

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-27833 · Security Note
• https://github.com/Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1c · Note
• https://piwigo.org/release-16.3.0 · Note
• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2 · Note