EUVD-2026-67803
GHSA-7r4r-rw6m-57g4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with low complexity; PR:L because a prior share relationship is required; confidentiality impact only, no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection.
AnalysisAI
Locked asset visibility bypass in Immich through 3.1.0 exposes private photo and video assets to unauthorized viewers via shared albums and shared links. When a user locks an asset using the single-asset locking endpoint, the lock flag is not enforced by the access control logic that governs shared album and shared link contexts, leaving those assets readable through pre-existing shares. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the attacker must possess a valid shared album membership or a shared link URL that was created before or after the asset was locked - these are not revoked by the locking action; and (2) the Immich instance must be reachable by the attacker over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects the primary risk: low-complexity network exploitation by any party holding a shared album membership or shared link, resulting in high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Immich to a version beyond 3.1.0 once a patched release is published; the upstream fix has been identified in commit 6b478924b25768dfea304ec3b8273b8316903304 in server/src/repositories/access.repository.ts, but a tagged release version containing this fix has not been independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all Immich 3.1.0 and earlier deployments to identify instances with active shared albums or shared links, review access logs for suspicious activity, and document which locked assets may have been exposed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Immich versions prior to 2.5.0 contain an improper access control flaw that allows any authenticated API key to escalate
Album ownership takeover in immich before 3.0.3 allows a user with shared-album editor access to escalate to full owner
Reflected cross-site scripting in Immich (commits 4ffa26c9 through pre-4eb1003) allows a single-click account takeover o
Immich prior to version 2.6.0 discloses shared album passwords in cleartext within URL query parameters during authentic
Stored Cross-Site Scripting in Immich photo management platform versions prior to 2.7.0 enables authenticated attackers
Open redirect vulnerability in Immich prior to version 2.7.3 allows authenticated attackers to craft malicious shared al
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today