Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck

CVE-2026-57945PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in photoprism from photoprism. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 74.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PUT users API endpoint to overwrite another user's profile details without authorization.

Affected products (as reported)

Vendor	Product	Versions
photoprism	photoprism	0 – before 260601-a7d098548

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Release Notes release-notes
Researcher Disclosure issue-tracking
https://www.vulncheck.com/advisories/photoprism-unauthorized-user-profile-modification-via-put-api-v1-users-uid-endpoint third-party-advisory