CVE-2026-123666

Name of the Vulnerable Software and Affected Versions Photo Engine (Media Organizer & Lightroom) versions prior to 6.6.2

Description Users with the Author role and above can permanently delete synced media belonging to other users, including administrators. This occurs because the plugin fails to verify if a user has the necessary permissions to delete media within a collection before the deletion process is executed. The issue is caused by a missing capability check in a function.

Recommendations Update to version 6.6.2 or later.