CVE-2026-82272

Received Received - Intake

Immich Asset Visibility Bypass via Shared Links

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82272

EUVD

EUVD-2026-67803

Affected Vendors & Products

Vendor	Product	Version / Range
immich	immich	to 3.1.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Immich through version 3.1.0 fails to enforce locked asset visibility when assets are locked via the single-asset endpoint. Locked assets remain accessible through shared albums and links, allowing attackers to read them and their metadata by accessing existing shared content. This bypasses the intended locked visibility protection.

Detection Guidance

To detect this vulnerability, check if locked assets in Immich remain accessible via shared albums or links. Verify if the single-asset update endpoint fails to remove assets from shared contexts. Inspect access control logs for unauthorized access attempts to locked resources.

Impact Analysis

This vulnerability allows unauthorized users to access locked assets and their metadata through shared albums or links. If you use Immich to store sensitive photos or videos, attackers could view private content even after locking it. It may also lead to data leaks or unauthorized exposure of personal information.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by exposing locked assets containing personal or sensitive data. Organizations may fail to meet requirements for data confidentiality and access controls, risking legal penalties and reputational damage.

Mitigation Strategies

Upgrade Immich to the latest version where this issue is patched. Review shared albums and links to ensure locked assets are not accessible. Implement stricter access controls and audit user permissions regularly.

Hi! I’m here to help you understand CVE-2026-82272. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70