CVE-2026-119330

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.

• CWE-285

• https://github.com/immich-app/immich/commit/6a61901e79972bbfe5690636a995e156219b9a8f
• https://github.com/immich-app/immich/pull/30762
• https://github.com/immich-app/immich/releases/tag/v3.2.0
• https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119317On Linux, an authenticated, low-privileged Nessus user with …6.5
• CVE-2026-11932IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…7.5
• CVE-2026-119325Bricks Theme 2.4 and before for WordPress contains an unauth…7.5
• CVE-2026-119328Immich is a high-performance self-hosted photo and video man…6.5
• CVE-2026-119329Immich is a high-performance self-hosted photo and video man…4.3
• CVE-2026-11933A use-after-free vulnerability exists in MongoDB Server's se…8.8
• CVE-2026-119331Ladybird is a truly independent web browser. Prior to the c0…7.1
• CVE-2026-119332Ladybird is a truly independent web browser. Prior to 209579…8.8
• CVE-2026-119333draw.io Desktop is the official Electron build of draw.io. P…7.8
• CVE-2026-119334Pi-hole is a DNS sinkhole that protects devices from unwante…2.2
• CVE-2026-119335Pi-hole is a DNS sinkhole that protects devices from unwante…7.8
• CVE-2026-119336Pi-hole is a DNS sinkhole that protects devices from unwante…7.8