CVE-2026-82985

Name of the Vulnerable Software and Affected Versions Photos app (affected versions not specified)

Description Filter-based smart albums build file listings using the photosSourceFolders search configuration of the user viewing the album instead of the album owner's configuration. This improper access control allows a user who has been shared a smart album to discover files, including names, file IDs, and other metadata, in folders that the owner did not intend to include. This issue requires the album owner to have shared a filter-based smart album with the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.