CVE-2026-27833

Piwigo: Unauthenticated Information Disclosure via pwg.history.search API

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

Affected

Piwigo

CVSS v3.1 GITHUB

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

1.70% chance of exploitation in the next 30 days, 77th percentile

Nuclei

high · CWE-862

Published

2026-04-03

Updated

2026-04-06

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27833.yaml

Security advisories

• Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2
• Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1c
• https://piwigo.org/release-16.3.0

References

• CVE Record
• NVD entry