No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 30 Oct 2026
- Last modified upstream: 05 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/immich-app/immich/commit/6a61901e79972bbfe5690636a995e156219b9a8f
- https://github.com/immich-app/immich/pull/30762
- https://github.com/immich-app/immich/releases/tag/v3.2.0
- https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93
- https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93
- Analysis, summary and remediation
- © VulnCrest