CVE-2026-103532CWE-266CWE-285

CVE-2026-103532

Medium · published October 1, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label "duplicate".

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00311 · 22.8th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2026-10-01T06:16Z
References (7)
https://github.com/immich-app/immich/ · [email protected]https://github.com/immich-app/immich/issues/29599 · [email protected]https://vuldb.com/cve/CVE-2026-103532 · [email protected]https://vuldb.com/submit/957120 · [email protected]https://vuldb.com/vuln/412344 · [email protected]https://vuldb.com/vuln/412344/cti · [email protected]https://github.com/immich-app/immich/issues/29599 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 01:15Z
    immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
    cvelistv5