CVE-2026-104079
Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint
Syed Balkhi Envira Gallery
CVSS
5.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.16.2Envira GalleryCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.
Text from CVE List
Affected versions 1
- Envira Galleryaffected: all versions before 1.16.2CVE List