CVE-2026-104079

Name of the Vulnerable Software and Affected Versions Envira Gallery Lite versions prior to 1.16.2

Description An authorization flaw exists in the gallery conversion REST endpoint. The endpoint verifies if a user can edit the source post but fails to check if they have the necessary permissions to publish a gallery, while simultaneously using a hard-coded publish status. This allows authenticated users with low privileges, such as those with Contributor roles, to create and publish galleries. Additionally, attackers can provide arbitrary image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use. Over 100,000 installations are potentially affected.

Recommendations Update to version 1.16.2.