TI-2026-69993 Aliases CVE-2026-104079 GHSA-hqrp-jfjc-rrfc

Envira Gallery Lite Missing Authorization via Gallery Conversion REST Endpoint

MEDIUM 57CWE-862Published 2026-10-09 · Updated 2026-10-27

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Envira Gallery Lite before 1.16.2 lacks an authorization check in its gallery conversion REST endpoint (CWE-862, Missing Authorization). The endpoint checks only edit permission on the source post and sets a hard-coded publish status, so authenticated users with lower privileges can create and publish Envira galleries without the required capabilities. Attackers can also submit arbitrary image IDs without an ownership check and publish content using attachments they are not authorized to use. CVSS 4.0 scores it 5.3 (MEDIUM); a proof-of-concept exploit is referenced, CISA SSVC rates it not automatable, and it is not in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0019 8th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Envira Gallery (Syed Balkhi): 1.16.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Syed Balkhi	Envira Gallery	before 1.16.2	1.16.2	Patch available	CNA

Envira Gallery VendorSyed Balkhi Affected before 1.16.2 Fixed in 1.16.2 Patch available CNA

Remediation

Update Envira Gallery Lite to version 1.16.2 or later, the fixed release from Syed Balkhi.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA Envira Gallery (Syed Balkhi) Fixed in 1.16.2

Timeline

2026-10-09 Threatist record created from CVE-2026-104079
2026-10-09 1 new reference · CNA
2026-10-09 Alias added: GHSA-hqrp-jfjc-rrfc
2026-10-14 CISA SSVC decision points changed
2026-10-14 Priority changed: LOW → MEDIUM

References

Exploit 1

Researcher Blog

Patch 1

WordPress Changelog

TI-2025-03299 WP Lightbox 2 < 3.0.6.8 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 6.3
TI-2020-19054 WPForms 1.7.8 - Cross-Site Scripting (XSS) CVSS 4.0MEDIUM 5.1
TI-2023-20897 WordPress Easy Digital Downloads plugin <= 3.1.5 - Broken Access Control CVSS 3.1CRITICAL 9.8
TI-2025-23256 WordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerability CVSS 3.1HIGH 8.8
TI-2026-63336 WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability CVSS 3.1HIGH 7.5
TI-2026-51984 WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5

See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences