CVE-2026-72540

Name of the Vulnerable Software and Affected Versions PhotoPrism versions prior to commit bb0b933

Description An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, the AlbumCover handler fails to verify if the requesting user is authorized to access a specific album before serving the cover image. Consequently, any user possessing a valid preview token can enumerate and download original-resolution cover photos from albums belonging to other users.

Recommendations Update PhotoPrism to commit bb0b933 or a later version.