Immich Locked Assets Remain Readable Through Albums and Shared Links

Advisories

Immich Locked Assets Remain Readable Through Albums and Shared Links

severity: high
date: 8/28/2026
Affecting: immich <= 3.1.0
CVE: CVE-2026-82272
CWE: CWE-863 Incorrect Authorization
CVSS: 7.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References: GitHub Issue #29526
https://github.com/immich-app/immich
Vulnerable code: asset.service.ts
Vulnerable code: access.repository.ts
Credit: George Chen
Description: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo