Unauthorized Access in Immich Photo and Video Management by Immich App

CVE-2026-119330

What is CVE-2026-119330?

In Immich, prior to version 3.2.0, an access control vulnerability existed in the shared-link creation API. It allowed an authenticated attacker to exploit the association between user assets and albums. By possessing a victim-owned asset UUID, an attacker could create a shared link for their album while leveraging the victim's asset, subsequently exposing sensitive metadata, thumbnails, and the byte-identical original files to subsequent unauthorized users. This vulnerability created a persistent sharing relationship that could be abused and redistributed. The issue was addressed in the release of version 3.2.0.

References