rootpwn

medium · CVSS v3 6.5

CVE-2026-82985

A logic flaw in the Photos app's filter-based smart albums causes file listings to evaluate against the viewing user's search configuration

Overview

A logic flaw in the Photos app's filter-based smart albums causes file listings to evaluate against the viewing user's search configuration rather than the owner's. This misattribution leads to unintended metadata disclosure when a smart album is shared. Defenders must address this information exposure vulnerability to prevent unauthorized file discovery.

Description

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched — allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album. This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.

Impact

The vulnerability results in an unauthorized information disclosure of file names, file IDs, and associated metadata. It affects privacy boundaries within shared smart albums where the viewing user's folder configuration overrides intended sharing scopes. The confidentiality of shared assets is compromised, though integrity and availability remain unaffected. Only users who have been explicitly granted access to a shared smart album can exploit this condition.

Remediation

Apply the latest security updates provided by the vendor for the Photos app. Audit existing shared smart albums to ensure sensitive folders are not inadvertently exposed. Review and enforce strict principle of least privilege regarding file sharing permissions.

Risk context

Rated as medium severity with a CVSS v3 score of 6.5, representing a moderate risk to data confidentiality. EPSS data is not currently available for this identifier. Mitigation should be prioritized during regular patch cycles.

Affected products

  • Photos app

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
—

information-disclosure access-control photos-app logic-flaw shared-albums

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-77164

A blind Server-Side Request Forgery vulnerability exists in the Nextcloud Circles app remote-instance signature verification process. Unauthenticated endpoints allow attackers to force the server to issue GET requests to arbitrary internal addresses before trust is established. While response bodies are not returned, this flaw enables internal network reconnaissance and service discovery.

View analysis

medium

CVE-2026-77170

An access control vulnerability exists in the Deck config API that permits authenticated users to modify board-scoped configuration keys for arbitrary board IDs. The issue stems from a lack of validation regarding whether the user owns or holds permissions to manage the targeted board. This matters because it enables unauthorized configuration tampering across organizational boundaries within the application.

View analysis

medium

CVE-2026-82980

An improper authorization vulnerability exists in the WebDAV plugin where absolute request URIs are resolved without validating user ownership. Any authenticated user can lock or unlock files belonging to other users, leading to denial of service or unauthorized modification control. This issue matters because it impacts data integrity and availability in multi-tenant or shared file environments.

View analysis