Log in Start free

Vulnerability · Published Oct 1, 2026 · Assigned by VulDB

CVE-2026-103532immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

Medium 5.3

In plain English

A medium-severity security flaw in Immich from immich-app. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 66.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label "duplicate".

Affected products (as reported)

VendorProductVersions
immich-app Immich 2.7.02.7.12.7.22.7.32.7.42.7.5

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C

References