Immich CVE-2026-103532

Exploitation requires that the Immich instance has at least one Shared Link configured with password protection, since the flaw is bypassing that password check in checkSharedLinkAccess (Shared Link Preview Handler). The attacker must also know or obtain the target shared link's URL/token. Per the CVSS vector it needs no authentication (PR:N), no user interaction (UI:N), and is remotely reachable (AV:N) at low complexity (AC:L); impact is limited to disclosure of that link's protected media (VC:L, no integrity/availability effect). A limiting factor is that instances not using password-protected sharing are unaffected, and the originating report was closed as a duplicate, so patch/fix status against current versions should be verified with the vendor.

Signals point to a real but bounded information-disclosure issue rather than a high-urgency priority. The vendor (VulDB) CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:L and VI:N/VA:N describes a remotely reachable, low-complexity, unauthenticated authorization flaw whose only impact is partial confidentiality loss - consistent with bypassing the password gate on a Shared Link to view otherwise-protected media, with no integrity or availability effect. No EPSS score, KEV listing, or POC was provided, so exploitation status is 'no public exploit identified at time of analysis.' A notable contradicting signal: the underlying GitHub issue (immich-app/immich#29599) was closed with the label 'duplicate,' which suggests the maintainers considered it already-known or already-addressed and casts doubt on whether this is a distinct, unpatched defect. The 6.9 score is a 4.0-scale artifact (unauthenticated network reach inflates the base) and should not be read as high real-world risk, since the realized impact is limited to the contents of specific password-protected shared links. Overall: a legitimate access-control weakness worth patching on Immich instances that use password-protected sharing, but not a mass-exploitation or emergency-response candidate on current evidence.

An attacker who knows or guesses the URL/token of a password-protected Immich Shared Link manipulates the Password argument handled by checkSharedLinkAccess so the server's authorization check passes without the correct password, exposing the shared photos/videos. The attack is remote and unauthenticated per the CVSS vector, but requires that a password-protected shared link actually exists and that its link identifier is known. No public exploit code or active exploitation has been identified.