immich — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in immich, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-103532	immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization CWE-285	5.3	Medium	2026-10-01
CVE-2026-82272	Immich Locked Assets Remain Readable Through Albums and Shared Links CWE-863	6.5	Medium	2026-08-28
CVE-2026-59258	immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser CWE-863	8.3	High	2026-07-15
CVE-2026-53662	immich: One-click account takeover via XSS in login page continue redirect CWE-79	9.6	Critical	2026-06-23
CVE-2026-40096	immich: Open Redirect via Shared Album name CWE-79	5.4	-	2026-04-14
CVE-2026-35455	immich has Stored XSS via OCR Text in 360° Panorama Viewer CWE-79	7.3	High	2026-04-08
CVE-2026-25118	immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums CWE-598	8.1^AI	High ^AI	2026-04-03
CVE-2026-23896	immich API Key Privilege Escalation vulnerability CWE-269	7.2	High	2026-01-29
CVE-2025-43856	immich allows account hijacking through oauth2 CWE-303	8.8^AI	High ^AI	2025-07-11

All 9 known CVE vulnerabilities affecting immich with full Chinese analysis, references, and POCs where available.