CVE-2026-82272CWE-863broken-access-control

CVE-2026-82272

Medium · published August 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.8
In the wild
Unconfirmed
What it is

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00436 · 36.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-29T00:20Z
References (5)
https://github.com/immich-app/immich · [email protected]https://github.com/immich-app/immich/blob/6b478924b25768dfea304ec3b8273b8316903304/server/src/repositories/access.repository.ts · [email protected]https://github.com/immich-app/immich/blob/6b478924b25768dfea304ec3b8273b8316903304/server/src/services/asset.service.ts · [email protected]https://github.com/immich-app/immich/issues/29526 · [email protected]https://www.vulncheck.com/advisories/immich-locked-assets-remain-readable-through-albums-and-shared-links · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:18Z
    Immich Locked Assets Remain Readable Through Albums and Shared Links
    cvelistv5