Description

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-25T23:16:57.313Z",
  "pubdate": "2026-08-25T23:16:57.313Z",
  "executiveSummary": "The Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery module is susceptible to a Missing Authorization vulnerability, which facilitates unauthorized forceful browsing.\nThis vulnerability affects versions 0.0.0 through 3.2.0 of the module.\nThe flaw stems from an inadequate implementation of access control checks within the module's functional components.\nThis missing authorization allows an unauthenticated or authenticated attacker with low-level privileges to interact with and access resources or gallery configurations that should otherwise be restricted.\nForceful browsing occurs when an attacker manually constructs URLs or navigates to paths they are not authorized to view, bypassing intended security controls.\nThe primary risk implication is the potential exposure of sensitive media metadata, private gallery structures, or restricted configuration settings managed by the module.\nAn attacker does not require advanced exploitation techniques, only the ability to craft HTTP requests targeting restricted resource identifiers within the Drupal environment.",
  "technicalDetails": "The vulnerability is identified as a Missing Authorization flaw within the PhotoSwipe - Responsive JavaScript Modal Image Gallery module for Drupal. The root cause is the failure of the module to enforce mandatory access control checks on specific internal request handlers or routing components responsible for retrieving or displaying gallery data.\nIn the affected versions (0.0.0 to 3.2.0), the module's backend logic fails to validate the current user's session or role permissions before processing requests for gallery content. Consequently, the application layer treats these requests as authorized by default, permitting the disclosure of information that should remain protected under the site's authorization policy.\nThe exploitation method relies on Forceful Browsing, a technique where the attacker intentionally navigates to URLs that are not explicitly linked via the user interface but are discoverable through predictable path structures or internal naming conventions within the module. Because the underlying code lacks a proper 'access callback' or permission check (e.g., in hook_menu or within controller logic), the system processes the request regardless of the user's privilege level.\nThe attack flow proceeds as follows: First, the attacker identifies the predictable URL patterns associated with the PhotoSwipe module's image gallery handling. Second, the attacker issues direct HTTP GET or POST requests to these paths. Third, the module processes the request, retrieves the requested media or gallery metadata from the database, and returns the response to the attacker. Because there is no authentication or authorization gatekeeper, the response is served successfully.\nThe impact of this post-exploitation behavior includes unauthorized access to protected gallery information, potential disclosure of private images that are intended to be hidden or restricted to specific user roles, and the mapping of internal site structures. The lack of validation ensures that the exposure is persistent and accessible to any actor capable of interacting with the Drupal web server. Since the vulnerability resides within the module's handling logic, it affects all instances where the module is active, regardless of the broader site configuration, unless external measures such as web application firewalls (WAFs) or strict routing restrictions are applied."
}