diff --git a/app/main/controllers/template/RTMediaTemplate.php b/app/main/controllers/template/RTMediaTemplate.php
index 2f1131a13..8946245ca 100755
--- a/app/main/controllers/template/RTMediaTemplate.php
+++ b/app/main/controllers/template/RTMediaTemplate.php
@@ -364,7 +364,7 @@ public function save_single_edit() {
 			$data_array = array( 'media_title', 'description', 'privacy' );
 			$_album_id  = filter_input( INPUT_POST, 'album_id', FILTER_SANITIZE_NUMBER_INT );
 			// for medias except album and playlist, if album_is is found, then update album_id for the media also.
-			if ( ! empty( $_album_id ) ) {
+			if ( ! empty( $_album_id ) && rtmedia_current_user_can_add_to_album( $_album_id ) ) {
 				$data_array[] = 'album_id';
 
 				// check it has an media id.
@@ -373,6 +373,8 @@ public function save_single_edit() {
 					// update the comment media album.
 					$comment->update_comment_media_album( $rtmedia_query->media[0]->media_id );
 				}
+			} else {
+				unset( $_POST['album_id'] );
 			}
 
 			$data  = rtmedia_sanitize_object( $_POST, $data_array ); // Properly Sanitized.
diff --git a/app/main/controllers/template/rtmedia-functions.php b/app/main/controllers/template/rtmedia-functions.php
index 68f582578..9261f87c1 100644
--- a/app/main/controllers/template/rtmedia-functions.php
+++ b/app/main/controllers/template/rtmedia-functions.php
@@ -971,16 +971,22 @@ function rtmedia_duration( $id = false ) {
  * Sanitizing object
  *
  * @param array $data Array of data.
- * @param array $exceptions Exception array.
+ * @param array $exceptions Allowlist of allowed keys to be sanitized.
  *
  * @return array
  */
 function rtmedia_sanitize_object( $data, $exceptions = array() ) {
-	$allowed_keys = array_merge( RTMediaMedia::$default_object, $exceptions );
+	if ( empty( $exceptions ) || ! is_array( $exceptions ) ) {
+		return array();
+	}
+
+	$allowed_keys = $exceptions;
 	$sanitized    = array();
 	foreach ( $data as $key => $value ) {
 		if ( in_array( $key, $allowed_keys, true ) ) {
-			if ( is_array( $value ) ) {
+			if ( 'privacy' === $key ) {
+				$sanitized[ $key ] = rtmedia_sanitize_privacy_level( $value );
+			} elseif ( is_array( $value ) ) {
 				$sanitized[ $key ] = rtmedia_sanitize_object( $value );
 			} elseif ( is_numeric( $value ) ) {
 				$sanitized[ $key ] = absint( $value );
diff --git a/app/main/controllers/upload/RTMediaUploadEndpoint.php b/app/main/controllers/upload/RTMediaUploadEndpoint.php
index 895ab1d17..fa2d1b6fb 100755
--- a/app/main/controllers/upload/RTMediaUploadEndpoint.php
+++ b/app/main/controllers/upload/RTMediaUploadEndpoint.php
@@ -267,6 +267,7 @@ public function template_redirect( $create_activity = true ) {
 							if ( empty( $privacy ) ) {
 								$privacy = 0;
 							}
+							$privacy = rtmedia_sanitize_privacy_level( $privacy );
 							$obj_activity = new RTMediaActivity( $update_activity_media, $privacy, false );
 
 							if ( ! empty( $same_medias[0] ) && ! empty( $activity_id ) ) {