CVE-2026-72540 in PhotoPrism
Summary
by MITRE • 08/11/2026
An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified album before serving the cover image. An attacker with any valid preview token can enumerate and download album cover images belonging to other users.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical insecure direct object reference flaw in PhotoPrism that undermines the application's authorization controls and exposes sensitive user data through improper access validation mechanisms. The issue manifests specifically within the AlbumCover handler component where the system fails to perform adequate authentication checks before serving original-resolution cover photos, creating a pathway for unauthorized data access.
The technical implementation of this vulnerability stems from the absence of proper access control verification within the album cover retrieval process. When a user requests an album cover image using a valid preview token, the system should validate whether that user has legitimate authorization to access the specified album before serving the content. However, the current implementation bypasses this crucial authorization check, allowing any authenticated user with a preview token to enumerate and access album cover images from other users' collections.
This flaw directly violates several security principles including the principle of least privilege and proper access control enforcement. The vulnerability enables unauthorized data enumeration and exfiltration through what should be a controlled access point, potentially exposing sensitive information about user content and collection patterns. Attackers can systematically enumerate album covers belonging to other users, creating detailed metadata profiles of user activities and content preferences.
The operational impact of this vulnerability extends beyond simple data exposure to encompass potential privacy violations and user trust degradation. Users expect their album collections and associated cover images to remain private and accessible only to authorized individuals. The ability for any authenticated user to access others' album covers creates a significant privacy breach that could expose personal information, relationships, or sensitive content patterns that users might not want publicly visible.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 which addresses improper access control issues and maps to ATT&CK technique T1078 for valid accounts and T1566 for credential access through application vulnerabilities. The flaw represents a classic example of insufficient authorization checks where the system assumes that having a valid token is sufficient authentication, ignoring the need for proper resource-level access control validation.
Mitigation strategies should focus on implementing robust access control verification within the AlbumCover handler before serving any album cover content. This includes validating user permissions against the requested album resource, implementing proper authorization checks using role-based access control mechanisms, and ensuring that all object references are validated against the requesting user's authorized resources. Additionally, organizations should consider implementing rate limiting and monitoring for unusual enumeration patterns to detect potential abuse of this vulnerability.
The fix requires modifying the AlbumCover handler to verify that the requesting user has appropriate permissions to access the specified album before serving the cover image. This validation should occur regardless of whether a valid preview token is presented, ensuring that only authorized users can retrieve album cover information from any collection within the system. Furthermore, comprehensive logging and monitoring should be implemented to detect and alert on unauthorized access attempts to album cover resources.
This vulnerability demonstrates the critical importance of proper authorization controls in web applications and highlights how seemingly minor implementation flaws can result in significant privacy and security consequences. The issue requires immediate attention through code review and patching to restore proper access control mechanisms and protect user data from unauthorized retrieval.