An omission in the configuration of the pwg.history.search API method allowed anyone who can reach the Piwigo web application to query and retrieve the complete browsing history of all users. The vulnerability permits the disclosure of potentially sensitive information such as recently viewed galleries and photos. The flaw is rooted in a missing administrative restriction (CWE‑862) and is therefore considered an information‑disclosure issue rather than an execution flaw. No direct code execution or privilege escalation is possible.

The defect impacts the Piwigo photo gallery application. All versions from the earliest releases up to, but not including, 16.3.0 are affected. Administrators deploying these older releases should verify whether the pwg.history.search API is exposed and consider upgrading to a patched version. The product is hosted on web servers and is typically accessible via HTTPS or HTTP.

The CVSS score of 7.5 indicates a high severity rating. The EPSS score below 1 percent suggests that real‑world exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack surface is publicly reachable; an unauthenticated attacker can simply perform HTTP requests to the exposed API endpoint. As it only yields information, the impact is limited to confidentiality, but an attacker could use the knowledge of visitor history for social engineering or phishing. Prompt application of the 16.3.0 patch is recommended.