The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries… (CVE-2026-16645)
The Photoswipe Drupal module integrates the PhotoSwipe lightbox library to display and zoom images in galleries. Versions prior to 3.2.0 do not sufficiently check access permissions when viewing images via the photoswipe image gallery display formatter. This vulnerability primarily affects sites that restrict access to images shown in photoswipe galleries. Public image galleries are not impacted by this issue.
AI Analysis
Technical Summary
The Photoswipe Drupal module, which integrates the PhotoSwipe lightbox library for image display and zoom functionality, has an access control vulnerability in versions before 3.2.0. Specifically, the module fails to properly verify user permissions when images are viewed through the photoswipe image gallery display formatter. This could allow unauthorized users to view images that should be access-restricted. The vulnerability is mitigated in typical use cases where images are publicly accessible, as the issue only affects sites that limit access to images displayed in photoswipe galleries.
Potential Impact
Unauthorized users may be able to view images that are intended to be access-restricted when using the photoswipe image gallery display formatter. This could lead to unintended disclosure of sensitive or private images on affected Drupal sites that use the Photoswipe module and restrict image access.
Mitigation Recommendations
Upgrade the Photoswipe Drupal module to version 3.2.0 or later, where this access permission issue has been fixed. Since this is a module vulnerability, applying the official module update is the recommended remediation. No other mitigations are indicated.
The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries… (CVE-2026-16645)
Description
The Photoswipe Drupal module integrates the PhotoSwipe lightbox library to display and zoom images in galleries. Versions prior to 3.2.0 do not sufficiently check access permissions when viewing images via the photoswipe image gallery display formatter. This vulnerability primarily affects sites that restrict access to images shown in photoswipe galleries. Public image galleries are not impacted by this issue.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Photoswipe Drupal module, which integrates the PhotoSwipe lightbox library for image display and zoom functionality, has an access control vulnerability in versions before 3.2.0. Specifically, the module fails to properly verify user permissions when images are viewed through the photoswipe image gallery display formatter. This could allow unauthorized users to view images that should be access-restricted. The vulnerability is mitigated in typical use cases where images are publicly accessible, as the issue only affects sites that limit access to images displayed in photoswipe galleries.
Potential Impact
Unauthorized users may be able to view images that are intended to be access-restricted when using the photoswipe image gallery display formatter. This could lead to unintended disclosure of sensitive or private images on affected Drupal sites that use the Photoswipe module and restrict image access.
Mitigation Recommendations
Upgrade the Photoswipe Drupal module to version 3.2.0 or later, where this access permission issue has been fixed. Since this is a module vulnerability, applying the official module update is the recommended remediation. No other mitigations are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- DRUPAL-CONTRIB-2026-088
- Osv Schema Version
- 1.7.0
- Aliases
- ["CVE-2026-16645"]
- Ecosystems
- ["Packagist:https://packages.drupal.org/8"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6151309c2644c7f8da72aa
Added to database: 07/22/2026, 23:24:32 UTC
Last enriched: 07/23/2026, 00:09:40 UTC
Last updated: 07/23/2026, 00:09:40 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.