CVE-2026-82272
Immich Locked Assets Remain Readable Through Albums and Shared Links
- State
- Published
- Severity
- 7.1 High
- Published
- Aug 28, 2026
- Updated
- Sep 24, 2026
- Reserved
- Aug 28, 2026
Description
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
immichimmich-app |
|
References
- GitHub Issue #29526issue-tracking
- https://github.com/immich-app/immichproduct
- Vulnerable code: asset.service.tstechnical-description
- Vulnerable code: access.repository.tstechnical-description
- VulnCheck Advisory: Immich Locked Assets Remain Readable Through Albums and Shared Linksthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.