CVE-2026-72540
Published Aug 11, 2026
CVSS n/a
EPSS n/a
KEV · Not listed
Description
Red Hat CNA-LR concluded that this CVE is not valid.
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
No reference.
History
Aug 17, 2026 3:30 PM
Title updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | PhotoPrism PhotoPrism - Insecure Direct Object Reference | |
| Metrics |
ssvc
|
Aug 17, 2026 2:30 PM
Weaknesses updated. References updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-639 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Aug 17, 2026 2:15 PM
Description updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified album before serving the cover image. An attacker with any valid preview token can enumerate and download album cover images belonging to other users. | Red Hat CNA-LR concluded that this CVE is not valid. |
Aug 11, 2026 5:45 PM
First appearance in the feed. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Photoprism
Photoprism photoprism |
|
| Vendors & Products |
Photoprism
Photoprism photoprism |
Aug 11, 2026 1:30 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Aug 11, 2026 11:30 AM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified album before serving the cover image. An attacker with any valid preview token can enumerate and download album cover images belonging to other users. | |
| Title | PhotoPrism PhotoPrism - Insecure Direct Object Reference | |
| Weaknesses | CWE-639 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
Weaknesses
No weakness.
