CVE-2026-111972: Photo Engine (Media Organizer & Lightroom) 0 to before 6.5.8

CVE-2026-111972. CVSS 3.1 base score 4.9 (MEDIUM, Source advisory).

Affected technology

Photo Engine (Media Organizer & Lightroom) · 0 to before 6.5.8
Vendor not specified by the source

Description’s affected range: before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Authenticated users with the author role and above can delete arbitrary media attachments, including those uploaded by other users and administrators. Source advisory’s CVSS 3.1 assessment (base score 4.9/10) rates confidentiality and availability impact as none; integrity impact as high.

Published 22-Oct-2026 11:32 UTC

CWE: CWE-639
CCR priority: 19.6 /100 (P5)
CVSS 3.1: 4.9 /10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N · Source advisory
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-22 11:32:15.865911+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-22 11:31:56.190834+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-111972.html