External risk intelligence

Drupal PhotoSwipe Missing Authorization Leads to Forceful Browsing

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-16645

The vulnerability affects a Drupal module used for image galleries. Drupal is a content management system commonly deployed as a public-facing web application. Since image galleries are typically displayed on the public-facing portions of websites to engage visitors, this component is likely to be exposed to the internet in common deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a Drupal module used for image galleries, specifically the PhotoSwipe component. This issue could allow unauthorized access to files if exploited, potentially impacting the confidentiality and integrity of hosted data. The main concern at this stage is confirming whether this specific module and its affected versions are in use within our environment.

Unauthorized file access is possible.
It affects image galleries on Drupal sites.
Confirm relevance and exposure of this module.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by navigating to specific, unauthorized parts of a Drupal website. This is possible because the PhotoSwipe module, used for image galleries, does not properly check if a user has permission to view certain files. If successful, an attacker could potentially access and view sensitive image files or related data.

No user authentication required.
Attacker browses to unauthorized files.
Risk of viewing sensitive files.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized access to image files when the Drupal PhotoSwipe module is used to display images. Attackers could potentially bypass intended access controls to view or retrieve images that were meant to be private or restricted.

Image files could be accessed.
Forceful browsing may occur.
Unauthorized viewing of images.

Operational Fix

Recommended remediation, mitigation, and detection steps

Identifying ownership for this vulnerability requires understanding which team manages the Drupal PhotoSwipe module. Typically, application owners or platform teams are responsible for managing contributed modules within a Drupal ecosystem. The immediate priority is to inventory all Drupal instances and confirm the presence and version of the affected PhotoSwipe module, assessing its external reachability and criticality to business operations before planning remediation.

Confirm module ownership and inventory instances.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Drupal PhotoSwipe module?

PhotoSwipe is a contributed module for Drupal that provides a responsive JavaScript-based modal gallery for displaying images. Developers and site administrators use it to create interactive, mobile-friendly image pop-ups for content, ensuring that photos on a webpage can be viewed in a full-screen overlay without forcing the user to leave the page.

What does CWE-862 mean for CVE-2026-16645?

CWE-862 refers to a 'Missing Authorization' weakness. In the context of this CVE, it means the module fails to verify if a user has the appropriate permissions before allowing them to access specific content. Because these checks are absent, the system grants requests for files that should otherwise be restricted or hidden, allowing an unauthorized person to view them.

How does an attacker trigger this vulnerability?

An attacker triggers the vulnerability by performing 'forceful browsing,' which involves manually requesting specific file paths or URLs within the website that the PhotoSwipe module manages. The exploit does not require the attacker to have an account or perform a login; simply knowing or guessing the path to the protected image files is sufficient to bypass the intended access controls.

Is my site at risk if it uses this module?

According to Halo Surface Signal, this vulnerability is highly relevant if your Drupal instance is public-facing. Because image galleries are typically displayed on the exterior portions of a website to engage visitors, the affected component is likely exposed to the internet. If your site is reachable by the public, you should prioritize verifying the status of this module immediately.

What should I do first to address this?

Your first step is to inventory all Drupal instances to confirm if they are running the PhotoSwipe module and check if the installed version is between 0.0.0 and 3.2.0. Once you have identified any affected sites, work with your application owners to evaluate the module's business necessity and prepare for remediation, such as updating or disabling the component.

References

www.drupal.org/sa-contrib-2026-088

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.