Description
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label "duplicate".
Published: 2026-10-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Improper Authorization
Action: Apply Patch
AI Analysis

Impact

The flaw resides in Immich’s Shared Link Preview Handler. By manipulating the Password argument supplied to the checkSharedLinkAccess function, an attacker can bypass the authorization check that normally protects preview access. This improper authorization allows the attacker to view private media links without possessing the correct password, potentially exposing sensitive personal photos or videos. The weakness corresponds to credential management (CWE‑266) and insufficient authorization (CWE‑285).

Affected Systems

This vulnerability affects all installations of Immich up to version 2.7.5. The issue originates from the function checkSharedLinkAccess located in server/src/utils/access.ts of the Shared Link Preview Handler. Users running any version of Immich within this range are impacted until the vendor releases a patch that corrects the authorization logic.

Risk and Exploitability

The CVSS base score of 6.9 indicates moderate severity, while no EPSS data is currently available, making the exact exploitation probability uncertain. The vulnerability can be triggered remotely via a crafted HTTP request to the preview endpoint, requiring no local user interaction. Although Immich is not currently listed in the CISA KEV catalog, the remote nature of the attack vector and the potential for sensitive media exposure warrant immediate attention from administrators.

Generated by OpenCVE AI on October 1, 2026 at 04:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Immich to a version newer than 2.7.5 where the checkSharedLinkAccess function has been fixed.
  • If a timely update is not possible, disable the Shared Link Preview feature or restrict its accessibility to trusted network segments only.
  • Implement an application firewall or reverse‑proxy rule to block unexpected or malformed Password parameters targeting the preview endpoint and monitor repeated attempts in the logs.

Generated by OpenCVE AI on October 1, 2026 at 04:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label "duplicate".
Title immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
First Time appeared Immich
Immich immich
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:immich:immich:*:*:*:*:*:*:*:*
Vendors & Products Immich
Immich immich
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Immich Immich
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-01T18:58:33.513Z

Reserved: 2026-09-30T19:06:55.475Z

Link: CVE-2026-103532

cve-icon Vulnrichment

Updated: 2026-10-01T18:58:24.371Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T02:16:53.600

Modified: 2026-10-01T19:17:18.227

Link: CVE-2026-103532

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T18:45:06Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization