Missing Authorization in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery
CVE-2026-16645

9.1CRITICAL

Key Information:

Vendor

Drupal
Status
Photoswipe - Responsive Javascript Modal Image Gallery
Vendor
CVE Published:
25 August 2026

What is CVE-2026-16645?

The PhotoSwipe - Responsive JavaScript Modal Image Gallery for Drupal is affected by a missing authorization vulnerability, allowing attackers to exploit this issue through forceful browsing. This can enable unauthorized access to protected resources, posing a threat to user data and application integrity. Users are advised to review their installed versions and update to remediate this vulnerability.

Affected Version(s)

PhotoSwipe - Responsive JavaScript Modal Image Gallery 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-088

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aleksi Peebles (aleksip)
Aleksi Peebles (aleksip)
Julian Pustkuchen (anybody)
Joshua Sedler (grevil)
cilefen (cilefen)
Damien McKenna (damienmckenna)
Neil Drumm (drumm)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.