CVE-2026-72540

An insecure direct object reference vulnerability in PhotoPrism allows any user with a valid preview token to access and download the original-resolution cover photos of albums they are not authorized to view. This could lead to unauthorized exposure of sensitive album information, impacting user privacy. Organizations using PhotoPrism should prioritize addressing this issue to protect user data and maintain trust.