CVE-2026-119330 Details
Description
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.
A vulnerability in Immich prior to version 3.2.0 allows authenticated users to create shared links for albums or assets belonging to other users. The issue arises because the shared link creation API does not properly validate the ownership of assets when linking them to albums. An attacker who knows the UUID of a victim's asset can exploit this flaw by creating a shared link for an album they own, while including the victim's asset in the link. This results in unauthorized access to the victim's asset metadata, thumbnails, and original files, creating a persistent sharing relationship that can be redistributed.
Users can update to Immich version 3.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/immich-app/immich/commit/6a61901e79972bbfe5690636a995e156219b9a8f | [email protected] | Source CodeVendor |
| https://github.com/immich-app/immich/pull/30762 | [email protected] | Source CodeVendor |
| https://github.com/immich-app/immich/releases/tag/v3.2.0 | [email protected] | Release NotesVendor |
| https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Immich | <= 3.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |