Photoview versions through 2.4.0 contain an authorization bypass in the shareAlbum GraphQL mutation, allowing authenticated users to generate unauthorized share tokens for albums owned by others.
Photoview
vulnerability
web-application
graphql
web-vulnerability
sql-injection
cve-2026-96673
1r
2t
1c
updated