CVE-2026-16645

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

We have discovered 10,508 live websites that are affected by CVE-2026-16645.

Run a Free Instant Scan



Affected Software

Product  PhotoSwipe
Category Widgets
Vulnerable Domains10,508 live websites (2.64% of PhotoSwipe install base)
Vulnerable Versions
  • from 0 through 3.2
Vulnerable Versions Count13 versions ( 14% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Aug 25, 2026
  • Updated - Aug 26, 2026

Credits

  • Aleksi Peebles (aleksip) (finder)
  • Aleksi Peebles (aleksip) (remediation developer)
  • Julian Pustkuchen (anybody) (remediation developer)
  • Joshua Sedler (grevil) (remediation developer)
  • cilefen (cilefen) (coordinator)
  • Damien McKenna (damienmckenna) (coordinator)
  • Neil Drumm (drumm) (coordinator)
  • Greg Knaddison (greggles) (coordinator)
  • Juraj Nemec (poker10) (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-16645
United States3,636 websites


Germany986 websites
France717 websites
Italy425 websites
Netherlands345 websites
Russia333 websites
GB310 websites
Japan303 websites
Poland235 websites
Taiwan214 websites

Website Distribution by TLD

Number of websites using CVE-2026-16645
.com4,678 websites
.de597 websites
.org432 websites
.net316 websites
.nl315 websites
.fr307 websites
.it304 websites
.ru269 websites
.co.uk206 websites
.pl184 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-16645

Top websites that are affected by CVE-2026-16645. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.org United States**,***
***************.org United States**,***
***.org France**,***
********.fr France**,***
********************.org United States**,***
************************.***.au Australia**,***
***.***.vn Vietnam**,***
********.com United States**,***
*****.net United States***,***
***************.com United States***,***
See full domain list

FAQ

CVE-2026-16645 is Missing Authorization in PhotoSwipe
A total of 10,508 websites have been identified as vulnerable to CVE-2026-16645, based on global website indexing conducted by WebTechSurvey.
The PhotoSwipe is affected by the CVE-2026-16645 vulnerability.
PhotoSwipe versions up to 3.2 are vulnerable to CVE-2026-16645.
CVE-2026-16645 is resolved in version 3.2 of PhotoSwipe.