A flaw in the shareAlbum GraphQL mutation permits an authenticated user to create share links for albums owned by others. By providing arbitrary album identifiers, attackers can generate active share tokens and expose photos and nested albums to any link holder while maintaining full control over token parameters. The primary consequence is the disclosure of private media via a link that the victim has no control over, representing a significant confidentiality breach.

The vulnerability affects the Photoview application, all versions through 2.4.0. Any deployment of Photoview that includes the shareAlbum mutation is at risk; the fix is applied in versions following 2.4.0.

Agents must first authenticate with the server; once authenticated, the exploit is trivial and immediate. Because the flaw resides in server-side code, no additional conditions such as network exposure are required. The CVSS score of 7.1 indicates high severity, while the EPSS score is currently unavailable and the vulnerability is not listed in CISA KEV. Attackers can readily create bypass links, so the likelihood of exploitation is plausible in environments where legitimate accounts exist and are not strongly monitored.