CVE-2026-103532 in Immich
Summary
by MITRE • 10/01/2026
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label "duplicate".
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in immich-app versions up to 2.7.5 represents a critical flaw within the Shared Link Preview Handler component, specifically residing in the checkSharedLinkAccess function located at file server/src/utils/access.ts. This security defect is classified as an improper authorization issue, which falls under the Common Weakness Enumeration category CWE-862: Missing Authorization. The core of the problem lies in how the application validates access to shared links that require password protection. When a user attempts to preview or access content via such a link, the system relies on the Password argument provided by the client request. However, due to insufficient validation logic within this specific function, an attacker can manipulate this input parameter to bypass authentication checks entirely. This means that even if a shared resource is configured with a password requirement, the application fails to correctly verify whether the supplied credential matches the expected value before granting access.
From a technical perspective, this flaw allows for remote exploitation without requiring any prior authentication or complex setup on the part of the attacker. The vulnerability stems from a logical error in the backend processing of shared link requests. Instead of strictly enforcing that the provided password must match the one set by the resource owner, the application may accept empty strings, malformed inputs, or specific crafted values that circumvent the verification routine. This behavior effectively neutralizes the security control intended to protect sensitive data behind these shared links. The fact that the associated GitHub issue was marked as a duplicate suggests this might be part of a broader pattern of authorization flaws in the codebase where similar checks are inconsistently implemented across different endpoints or functions, indicating a systemic weakness rather than an isolated incident.
The operational impact of this vulnerability is significant for any organization or individual using immich to store and share personal media files. Shared links with passwords are commonly used as a convenient method for distributing sensitive images, videos, or documents without the overhead of managing user accounts on the platform. By exploiting this flaw, an unauthorized actor can gain immediate access to these private resources simply by modifying the request parameters sent to the server. This leads directly to data exposure and potential privacy violations. Since immich is often deployed in self-hosted environments where users may have varying levels of security expertise, they might rely heavily on these password-protected links as their primary defense mechanism against unauthorized access. The bypassing of this control undermines trust in the platform's ability to enforce access policies correctly.
In terms of industry frameworks, this vulnerability aligns with MITRE ATT&CK technique T1078: Valid Accounts, specifically when considering how valid credentials or tokens are misused or bypassed to gain unauthorized access. It also relates to T1528: Steal Application Access Token if the shared link mechanism relies on token-based authentication that is similarly flawed in its validation logic. The lack of proper authorization checks allows an attacker to traverse from a public-facing entry point directly into protected data stores, effectively skipping the intended gatekeeping mechanisms. This type of flaw is particularly dangerous because it can be automated easily by attackers scanning for exposed shared links with weak or predictable password configurations, although this specific vulnerability works even without guessing passwords due to the logic bypass.
To mitigate this risk, users running immich versions up to 2.7.5 should immediately upgrade to a patched version where the checkSharedLinkAccess function has been corrected to enforce strict password validation. Until an update is available or if upgrading is not feasible in the short term, administrators can implement compensating controls at the network level. This includes restricting access to the immich server through firewalls or reverse proxies that require additional authentication layers before requests reach the application backend. Additionally, disabling shared links entirely for highly sensitive content until a secure version is deployed reduces the attack surface significantly. It is also advisable to review other areas of the codebase where similar authorization checks are performed to ensure no other endpoints suffer from comparable logic errors. Regular security audits and static analysis tools focused on authentication bypass vulnerabilities can help identify such weaknesses early in future development cycles, ensuring that access control mechanisms remain robust against manipulation attempts.