Changing album group permissions doesn't work properly #1861

New Issue

2026-10-05T00:58:57+02:00

adam commented

2026-10-05 00:58:57 +02:00

If I change album permissions for a user group, e.g. make a sub-album private, I can do that via the admin panel -> Users -> Groups -> Manage permissions. The issue is that the album doesn't actually become private. It is still visible to users from that group. However, it will be private to newly registered users that by default belong to that group. So you end up with users belonging to the same user group seeing different things, maybe even albums that you want to be private. This is a bit of a serious security issue.

The workaround is moving the whole album to the 'Forbidden' section and then moving the ones that you want to make public back to the 'Authorized' section. This is not clear at all that this is how it works and now I wonder how many albums in my gallery are public to certain user groups when they should be private....

If I change album permissions for a user group, e.g. make a sub-album private, I can do that via the admin panel -> Users -> Groups -> Manage permissions. The issue is that the album doesn't actually become private. It is still visible to users from that group. However, it will be private to newly registered users that by default belong to that group. So you end up with users belonging to the same user group seeing different things, maybe even albums that you want to be private. This is a bit of a serious security issue. The workaround is moving the whole album to the 'Forbidden' section and then moving the ones that you want to make public back to the 'Authorized' section. This is not clear at all that this is how it works and now I wonder how many albums in my gallery are public to certain user groups when they should be private....

adam commented

2026-10-05 00:58:58 +02:00

Hello
That's concerning.
could you provide a step by step procedure to reproduce with urls of the pages. That's the best way to be sure there is no misunderstanding. Thank you

Hello That's concerning. could you provide a step by step procedure to reproduce with urls of the pages. That's the best way to be sure there is no misunderstanding. Thank you

adam commented

2026-10-05 00:58:59 +02:00

Hello,

I cannot provide URLs because my gallery is private. But if that is indeed an issue with Piwigo and not with my installation then you should be able to reproduce it via the following:

Create an album with sub-albums.
Create a user group that is the default group users get assigned to when they register.
Add a user to that group.
Make one of the subalbums not accessible to that group via Users -> Groups -> Manage Permissions.
That user will still be able to see and access the album.
Create a new user and that user will not be able to see it.

Hello, I cannot provide URLs because my gallery is private. But if that is indeed an issue with Piwigo and not with my installation then you should be able to reproduce it via the following: 1) Create an album with sub-albums. 2) Create a user group that is the default group users get assigned to when they register. 4) Add a user to that group. 3) Make one of the subalbums not accessible to that group via Users -> Groups -> Manage Permissions. 4) That user will still be able to see and access the album. 5) Create a new user and that user will not be able to see it.

adam commented

2026-10-05 00:59:00 +02:00

Any updates on this?

Any updates on this?

adam commented

2026-10-05 00:59:00 +02:00

2 questions :

is the user an admin?
do you have configured a custom $conf['inheritance_by_default'] ?

2 questions : 1. is the user an admin? 2. do you have configured a custom `$conf['inheritance_by_default']` ?

adam commented

2026-10-05 00:59:01 +02:00

No the user is not an admin
No I don't.

Are you able to reproduce the issue on your end?

1. No the user is not an admin 2. No I don't. Are you able to reproduce the issue on your end?

adam commented

2026-10-05 00:59:02 +02:00

I replicated the bug using those steps on a fresh install of 15.4.0. The sub-album is in the Forbidden list but the user account can still view it.

Next I looked at the sub-album in Albums -> Manage -> Edit -> Permissions - my "default group" group is not listed there. Clicking Save (without changing anything) sets the expected permissions, the user account can no longer see the sub-album.

I have $conf['newcat_default_status'] = 'private'; in my config file, that's the only change to it.

I replicated the bug using those steps on a fresh install of 15.4.0. The sub-album is in the ```Forbidden``` list but the user account can still view it. Next I looked at the sub-album in ```Albums -> Manage -> Edit -> Permissions``` - my "default group" group is not listed there. Clicking Save (without changing anything) sets the expected permissions, the user account can no longer see the sub-album. I have ```$conf['newcat_default_status'] = 'private';``` in my config file, that's the only change to it.

adam commented

2026-10-05 00:59:02 +02:00

I can't reproduce the bugs described here. @HWFord can you?

I can't reproduce the bugs described here. @HWFord can you?

adam commented

2026-10-05 00:59:03 +02:00

Noting that I am using https://github.com/linuxserver/docker-piwigo

Noting that I am using https://github.com/linuxserver/docker-piwigo

Sign in to join this conversation.

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#1861