CVE-2026-119330— Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API

Quick assessment

Affected

immich-app immich

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Immich 是一个高性能的自托管照片与视频管理解决方案。在 3.2.0 版本之前，其共享链接创建 API（位于）将和作为独立字段接收，但仅对请求中指定的链接类型所对应的资源进行授权。若一名已认证的攻击者事先知晓某受害者拥有的资源 UUID，即可在创建共享链接时选择指向攻击者自身拥有的相册，同时将受害者的资源 UUID 填入字段。方法会将该未经校验的关联关系持久化至表中，导致受害者的资源可通过新生成的匿名共享链接凭证被访问。此漏洞暴露了受害者的元数据、缩略图以及字节完全相同的原始文件，并建立了一种可被

CVSS 3.5 · Low Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API

Source: CVE Program / CVE List V5

Vulnerability Description

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
immich-app	immich	< 3.2.0	-

II. Public POCs for CVE-2026-119330

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119330

请登录查看更多情报信息。

Other References for CVE-2026-119330 (4)

https://github.com/immich-app/immich/pull/30762 x_refsource_MISC
https://github.com/immich-app/immich/releases/tag/v3.2.0 x_refsource_MISC
https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93 x_refsource_CONFIRM
https://github.com/immich-app/immich/commit/6a61901e79972bbfe5690636a995e156219b9a8f x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119330

Same Patch Batch · immich-app · 2026-10-30 · 3 CVEs total

CVE-2026-119328	6.5 MEDIUM	Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive d
CVE-2026-119329	4.3 MEDIUM	Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets

IV. Related Vulnerabilities

Same product: immich

Same vendor: immich-app

Same weakness: CWE-285