CVE-2026-6566 Missing authorization in Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Authenticated users with gallery management capabilities can delete other users' images due to insufficient ownership checks in the REST API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6566?
CVE-2026-6566 is a medium-severity missing authorization vulnerability in smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery, published on 20 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default).
Weakness: CWE-639
Which versions are affected by CVE-2026-6566?
How do I fix CVE-2026-6566?
No fix has been published for CVE-2026-6566 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-6566 being exploited?
There is no known exploitation of CVE-2026-6566 in the wild and no public exploit code.
Sources
Also known as GHSA-4hjj-956w-4cwm.