Joseph Semaan

**Name of the Vulnerable Software and Affected Versions** Photos app (affected versions not specified) **Description** Filter-based smart albums build file listings using the `photosSourceFolders` search configuration of the user viewing the album instead of the album owner's configuration. This improper access control allows a user who has been shared a smart album to discover files, including names, file IDs, and other metadata, in folders that the owner did not intend to include. This issue requires the album owner to have shared a filter-based smart album with the attacker. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.