CVE-2026-119330

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/immich-app/immich/commit/6a61901e79972bbfe5690636a995e156219b9a8f
https://github.com/immich-app/immich/pull/30762
https://github.com/immich-app/immich/releases/tag/v3.2.0
https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93

Configurations

No configuration.

History

30 Oct 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-30 20:17

Updated : 2026-10-30 20:17

NVD link : CVE-2026-119330

Mitre link : CVE-2026-119330

CVE.ORG link : CVE-2026-119330

JSON object : View

Products Affected

No product.

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-119330", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "immich-app", "product": "immich", "versions": [{"status": "affected", "version": "< 3.2.0"}]}]}], "published": "2026-10-30T20:17:06.943", "references": [{"url": "https://github.com/immich-app/immich/commit/6a61901e79972bbfe5690636a995e156219b9a8f", "source": "security-advisories@github.com"}, {"url": "https://github.com/immich-app/immich/pull/30762", "source": "security-advisories@github.com"}, {"url": "https://github.com/immich-app/immich/releases/tag/v3.2.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0."}], "lastModified": "2026-10-30T20:17:07.067", "sourceIdentifier": "security-advisories@github.com"}