CVE-2026-57945: PhotoPrism Broken Access Control Allows Unauthorized User Profile Modification

Technical summary

CVE-2026-57945 is a broken access control vulnerability in the PhotoPrism PUT users API endpoint. The vulnerability stems from missing session-to-user identifier validation, meaning the application fails to enforce ownership checks when processing profile modification requests. An authenticated attacker can craft requests targeting arbitrary user endpoints and successfully overwrite another user's profile information without receiving authorization errors. The core issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), a category of flaws where user-supplied or attacker-controlled data is used to determine access rights without proper server-side validation. The vulnerability affects PhotoPrism versions prior to 260601-a7d098548.

Business impact

This vulnerability creates a risk of unauthorized user data modification and potential identity-related attacks within PhotoPrism deployments. An authenticated insider, competitor with valid credentials, or attacker who has compromised a low-privilege account can alter other users' profiles—potentially changing email addresses, display names, or other metadata. In organizations relying on PhotoPrism for photo sharing or collaboration, this could disrupt workflows, cause reputational damage if user profiles are vandalized, or enable further social engineering attacks if an attacker modifies a legitimate user's contact information. However, the impact is limited to profile data integrity; the vulnerability does not grant access to encrypted photos, passwords, or administrative controls.

Affected systems

PhotoPrism versions prior to build 260601-a7d098548 are affected. The vulnerability is present in the user management API layer and affects any PhotoPrism instance where multiple authenticated users exist. Deployments with only a single admin user and no additional accounts face minimal risk, as do fully isolated or air-gapped PhotoPrism installations. Public or multi-tenant PhotoPrism instances, or those used in organizations with multiple user accounts, are at higher risk.

Exploitability

The barrier to exploitation is relatively low from a technical perspective—an attacker needs only valid login credentials and knowledge of another user's ID number, both of which are often discoverable or readily available in multi-user environments. No special tools, complex payloads, or zero-day techniques are required; standard HTTP PUT requests suffice. However, the requirement for valid authentication means this is not a vulnerability that can be exploited by anonymous or unauthenticated attackers. The lack of CVSS:3.1/AC:L (Attack Complexity: Low) indicates straightforward attack mechanics, though the PR:L (Privileges Required: Low) and limited impact (no confidentiality loss, minor integrity impact) keep the overall severity at MEDIUM.

Remediation

Upgrade PhotoPrism to version 260601-a7d098548 or later. This version includes fixes for session-to-user identifier validation in the PUT users API endpoint. After patching, conduct an audit of recent profile modifications to identify any unauthorized changes made by attackers during the window of exposure. If feasible, restore user profiles from backups if tampering is detected. Additionally, review user access logs for suspicious API activity patterns, such as repeated requests to modify multiple user accounts from a single source IP or session.

Patch guidance

Verify the installed PhotoPrism version and confirm it is at or beyond build 260601-a7d098548. Review the official PhotoPrism release notes and security advisories for any additional configuration or deployment recommendations. Test the patch in a non-production environment first to ensure compatibility with your PhotoPrism installation and any custom extensions or integrations. After deployment, monitor API logs for continued exploitation attempts and validate that users can only modify their own profiles.

Detection guidance

Search API logs and web server access logs for PUT requests to /users or /api/users endpoints where the session user ID does not match the target user ID in the request. Look for patterns of multiple user IDs being targeted by the same authenticated session, or repeated modification attempts that span a time window before the patch was deployed. Implement or enhance monitoring on user profile modification events to alert when a user's email, name, or other key attributes change unexpectedly. Consider deploying a Web Application Firewall (WAF) rule to flag or block PUT requests to user endpoints where the authenticated user differs from the target user until patching is complete.

Why prioritize this

This vulnerability should be prioritized for patching in any PhotoPrism deployment with multiple user accounts, particularly if the service is accessible over the internet or within an untrusted network. While the CVSS:3.1 score of 4.3 (MEDIUM) reflects limited direct harm per exploit, the ease of exploitation—combined with the reputational and operational risk of user data tampering—makes it more urgent than the score alone suggests. Organizations with strict data integrity or compliance requirements (e.g., HIPAA, GDPR) should prioritize this patch to maintain audit trails and prevent unauthorized profile modifications. Conversely, single-user or fully isolated PhotoPrism instances can safely defer patching beyond critical security updates.

Risk score, explained

The CVSS:3.1 score of 4.3 reflects a MEDIUM severity rating. The score accounts for network-based attack vector (AV:N), low attack complexity (AC:L), and requirement for low privileges (PR:L)—all factors that increase exploitability. However, the integrity impact is low (I:L) because only profile metadata is compromised, not photos or system settings. There is no confidentiality or availability impact (C:N/A:N), which prevents a higher score. The unchanged scope (S:U) indicates no impact beyond the vulnerable application itself. In practice, many organizations assign higher risk to this issue due to its ease of exploitation and potential for insider misuse, even if the textbook CVSS score is moderate.

Frequently asked questions