CVE-2014-4613: Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows r...

Security readout for executives and security teams

Older Piwigo gallery installations could let an attacker trick a logged-in administrator into creating a user. The attacker still needs an administrator’s browser session to be abused, but successful exploitation can change account state without the administrator’s intent. Exposure is limited to Piwigo installations older than 2.6.2, especially where administrators browse while logged in. The bundle does not identify other affected products or versions beyond Piwigo before 2.6.2. Treat this as a moderate cleanup priority for any legacy Piwigo estate. It is not shown as actively exploited here, but public exploit references and unauthorized account creation make upgrade verification worthwhile. Mitigation focus: Upgrade Piwigo to version 2.6.2 or later.; Review vendor release notes and bug tracker guidance for the fixed release.; Restrict access to the administration panel where operationally possible..

Prepared

Jun 7, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.