Immich EUVD-2026-67803

Exploitation requires two concurrent conditions: (1) the attacker must possess a valid shared album membership or a shared link URL that was created before or after the asset was locked - these are not revoked by the locking action; and (2) the Immich instance must be reachable by the attacker over the network. The CVSS PR:L rating reflects that some prior sharing relationship or link possession is necessary. Exploitation is limited to confidentiality - no write or delete capability is gained. Assets that were never shared, or whose shares have been manually revoked prior to locking, are not accessible via this bypass. The flaw does not affect assets locked before any sharing context is created if no album or link for those assets exists.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects the primary risk: low-complexity network exploitation by any party holding a shared album membership or shared link, resulting in high confidentiality impact. The PR:L designation is important - exploitation is gated on possessing a valid shared link or album membership, which limits the attacker population to recipients of prior shares. EPSS data is not provided and no KEV listing exists, so widespread automated exploitation is not confirmed. The real-world risk is most acute in deployments where Immich instances are exposed to the internet and where users have previously shared albums or links with external parties before later deciding to lock specific assets - the lock gives a false sense of revocation that does not hold. Organizations running community or family Immich instances with broad sharing practices face meaningfully higher exposure than those using it in isolated LANs.

An attacker who previously received a shared album link from an Immich user browses that album after the owner has locked specific sensitive assets via the single-asset lock endpoint. Because the access repository does not enforce the lock flag in the shared-link context, the attacker's HTTP request to retrieve the asset and its metadata succeeds and returns the full content. No exploit code is required beyond a standard HTTP client - the bypass is a logic gap, not a memory corruption or injection flaw.