{"id":"CVE-2026-119330","kind":"vulnerability","aliases":["CVE-2026-119330"],"related":[],"title":"Immich: shared-link API lets a user share another user's photos","description":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.","summary":"An authenticated Immich user who knows another user's asset ID can attach that photo to their own shared link. The anonymous link then exposes the victim's thumbnail, metadata and original file.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["immich","package","photos","self-hosted"],"not_affected_if":["single-user-instance","version-3.2.0-or-later"],"how_to_check":"- Check the Immich server version, for example with `docker exec immich_server cat /usr/src/app/package.json` or the image tag in your compose file.\n- Review existing shared links for assets you did not create.","fix":"- Immich: upgrade to `3.2.0` or later.","status":"open","published_at":"2026-10-30T20:17:06+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:55+00:00","updated_at":"2026-10-30T20:26:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T20:26:55Z","model":"claude-haiku-5-5","output":{"fix":"- Immich: upgrade to `3.2.0` or later.","reach":"network","title":"Immich: shared-link API lets a user share another user's photos","impact":"medium","summary":"An authenticated Immich user who knows another user's asset ID can attach that photo to their own shared link. The anonymous link then exposes the victim's thumbnail, metadata and original file.","audience":"businesses","category":"package","nicknames":[],"who_cares":["immich","self-hosted","photos"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"another user's photos and originals become publicly shareable","analyst_note":"","how_to_check":"- Check the Immich server version, for example with `docker exec immich_server cat /usr/src/app/package.json` or the image tag in your compose file.\n- Review existing shared links for assets you did not create.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.2.0-or-later","single-user-instance"],"who_is_affected":"Self-hosted Immich servers running a version before 3.2.0 where users can create shared links. An attacker needs a regular account and the victim's asset UUID, which is hard to guess but may leak. Instances with a single user or without shared links enabled for other accounts carry less risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":4266,"output_tokens":478,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-119330':16A,19A '-2026':15A,18A '3.2.0':75C,180C 'accept':82C 'album':122C 'albumid':83C 'alreadi':106C 'anonym':47B,147C 'anoth':10A,32B 'api':5A,81C 'asset':35B,112C,137C,142C 'assetid':85C,128C 'associ':133C 'attach':38B 'attack':104C,120C 'attacker-own':119C 'authent':27B,103C 'author':92C 'avail':143C 'byte':160C 'byte-ident':159C 'could':114C,171C 'creat':165C 'creation':80C 'credenti':151C 'cve':14A,17A 'expos':50B,153C 'field':88C 'file':58B,163C 'fix':177C 'high':63C 'high-perform':62C 'host':25B,67C 'id':36B 'ident':161C 'immich':1A,20B,28B,59C 'independ':87C 'issu':175C 'knew':107C 'know':31B 'let':6A 'link':4A,45B,48B,79C,100C,136C,150C 'made':139C 'manag':71C 'metadata':55B,155C 'new':146C 'origin':57B,162C 'own':111C,121C 'packag':21B 'perform':64C 'persist':130C,167C 'photo':13A,22B,40B,68C 'prior':73C 'redistribut':173C 'relationship':169C 'request':99C 'resourc':95C 'select':96C,115C 'self':24B,66C 'self-host':23B,65C 'server/src/services/shared-link.service.ts':90C 'share':3A,9A,44B,78C,135C,149C,168C 'shared-link':2A,77C,148C 'sharedlinkservice.create':129C 'sharedlinktype.album':116C 'solut':72C 'suppli':124C 'thumbnail':54B,156C 'type':101C 'uncheck':132C 'user':8A,11A,29B,33B 'uuid':113C,126C 'version':179C 'victim':52B,110C,141C,154C 'victim-own':109C 'video':70C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Immich servers running a version before 3.2.0 where users can create shared links. An attacker needs a regular account and the victim's asset UUID, which is hard to guess but may leak. Instances with a single user or without shared links enabled for other accounts carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119330","severity":null,"published_at":"2026-10-30T20:17:06+00:00","modified_at":"2026-10-30T20:17:07+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}