A critical missing authorization flaw in the Drupal PhotoSwipe module allows unauthenticated remote attackers to access restricted gallery data or modify configurations, posing a severe risk to site integrity.

This vulnerability is a missing authorization flaw (CWE-862) that permits unauthenticated users to bypass access controls and engage in forceful browsing. The issue exists because the module fails to verify user permissions before granting access to sensitive gallery functions.

The CVSS score of 9.1 underscores the severity of this vulnerability, as it allows unauthenticated attackers to gain unauthorized access to sensitive information or manipulate gallery content. Successful exploitation could lead to significant data breaches, unauthorized disclosure of private images, or the compromise of site administrative settings, resulting in reputational damage and potential loss of intellectual property.

Immediate Action: Update the Drupal PhotoSwipe module to version 3.2.0 or the latest available release as provided by the vendor. If an update is not immediately available, disable the module until a secure version can be deployed.

Proactive Monitoring: Review web server and Drupal access logs for suspicious patterns, particularly requests directed toward gallery configuration endpoints or unauthorized path traversal attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to administrative or sensitive module endpoints, effectively acting as a virtual patch until the module is updated.

Public Exploit Available: Unknown

Given the critical nature of this flaw and its potential for unauthenticated exploitation, administrators must prioritize the remediation of this module. Apply the necessary updates immediately to ensure that access control checks are correctly enforced and to prevent unauthorized access to the application environment.