CVE-2026-16645

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16645", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-07-22T17:06:46.782Z", "datePublished": "2026-08-25T22:21:47.480Z", "dateUpdated": "2026-08-26T18:41:49.991Z"}, "containers": {"cna": {"title": "PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088", "datePublic": "2026-07-22T18:01:57.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-088"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/photoswipe", "product": "PhotoSwipe - Responsive JavaScript Modal Image Gallery", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/photoswipe", "versions": [{"lessThan": "3.2.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0."}], "credits": [{"lang": "en", "type": "finder", "value": "Aleksi Peebles (aleksip)"}, {"lang": "en", "type": "remediation developer", "value": "Aleksi Peebles (aleksip)"}, {"lang": "en", "type": "remediation developer", "value": "Julian Pustkuchen (anybody)"}, {"lang": "en", "type": "remediation developer", "value": "Joshua Sedler (grevil)"}, {"lang": "en", "type": "coordinator", "value": "cilefen (cilefen)"}, {"lang": "en", "type": "coordinator", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "coordinator", "value": "Neil Drumm (drumm)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-08-25T22:21:47.480Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T18:41:28.658677Z", "id": "CVE-2026-16645", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T18:41:49.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-16645", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T18:41:28.658677Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T18:41:43.363Z"}}], "cna": {"title": "PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088", "credits": [{"lang": "en", "type": "finder", "value": "Aleksi Peebles (aleksip)"}, {"lang": "en", "type": "remediation developer", "value": "Aleksi Peebles (aleksip)"}, {"lang": "en", "type": "remediation developer", "value": "Julian Pustkuchen (anybody)"}, {"lang": "en", "type": "remediation developer", "value": "Joshua Sedler (grevil)"}, {"lang": "en", "type": "coordinator", "value": "cilefen (cilefen)"}, {"lang": "en", "type": "coordinator", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "coordinator", "value": "Neil Drumm (drumm)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/photoswipe", "vendor": "Drupal", "product": "PhotoSwipe - Responsive JavaScript Modal Image Gallery", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.2.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/photoswipe"}], "datePublic": "2026-07-22T18:01:57.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-088"}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-08-25T22:21:47.480Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16645", "state": "PUBLISHED", "dateUpdated": "2026-08-26T18:41:49.991Z", "dateReserved": "2026-07-22T17:06:46.782Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-08-25T22:21:47.480Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.drupal.org/project/photoswipe", "product": "PhotoSwipe - Responsive JavaScript Modal Image Gallery", "repo": "https://git.drupalcode.org/project/photoswipe", "vendor": "Drupal", "versions": [{"lessThan": "3.2.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "source": "mlhess@drupal.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0."}], "id": "CVE-2026-16645", "lastModified": "2026-08-28T15:29:44.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16645", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T18:41:28.658677Z", "version": "2.0.3"}}]}, "published": "2026-08-25T23:16:57.313", "references": [{"source": "mlhess@drupal.org", "url": "https://www.drupal.org/sa-contrib-2026-088"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "mlhess@drupal.org", "type": "Secondary"}]}

{"bugzilla": {"description": "photoswipe: PhotoSwipe: Unauthorized access due to missing authorization", "id": "2524176", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524176"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-425", "details": ["Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.", "A flaw was found in PhotoSwipe - Responsive JavaScript Modal Image Gallery. This missing authorization vulnerability allows an attacker to perform forceful browsing, potentially leading to unauthorized access to sensitive information or resources. By exploiting this flaw, an attacker can bypass intended access controls."], "name": "CVE-2026-16645", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Not affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}], "public_date": "2026-08-25T22:21:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-16645\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-16645\nhttps://www.drupal.org/sa-contrib-2026-088"], "statement": "This Important vulnerability in Drupal PhotoSwipe does not affect Red Hat products as the vulnerable code is not present in the versions shipped with Red Hat offerings.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,3.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "PhotoSwipe - Responsive JavaScript Modal Image Gallery", "source": "cna", "vendor": "Drupal"}, "product": "photoswipe_-_responsive_javascript_modal_image_gallery", "vendor": "drupal"}], "created": "2026-08-26T01:30:16.693937+00:00", "updated": "2026-08-28T20:34:11.793112+00:00", "vendors": ["drupal", "drupal$PRODUCT$photoswipe_-_responsive_javascript_modal_image_gallery"]}