CVE-2026-103532

immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

6.9 Medium

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label "duplicate".

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.39%Up 0.1 points since Oct 2, 2026

What each source reports

CVE List Score used 6.9

immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

Record: CVE-2026-103532
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C
CVSS 2.0: 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:C
Weakness: CWE-285, CWE-266
Updated: 2026-11-02

EUVDEUVD-2026-90451 6.9

Record: EUVD-2026-90451
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pr8c-q9fw-jxc3 6.9

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function...

Record: GHSA-pr8c-q9fw-jxc3
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-266
Updated: 2026-11-02

NVD 6.9

Record: CVE-2026-103532
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-266, CWE-285
Updated: 2026-11-02

OSV 6.9

immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

Record: CVE-2026-103532
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Weakness: CWE-266, CWE-285
Updated: 2026-11-02

Affected products

immich-app immich

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-103532 is a medium vulnerability (CVSS 6.9) in Immich-app Immich, published October 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. No source names a fixed version.