{"id":"CVE-2026-119330","aliases":["EUVD-2026-114377","GHSA-g4w3-c888-cr93"],"status":"published","title":"Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API","description":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00222,"percentile":0.12907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2026-10-30T19:53:29Z","modified":"2026-11-05T03:17:19Z","products":[{"vendor":"immich-app","product":"immich"}],"references":[{"url":"https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/immich-app/immich/pull/30762","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/immich-app/immich/commit/6a61901e79972bbfe5690636a995e156219b9a8f","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/immich-app/immich/releases/tag/v3.2.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119330.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119330","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-119330","title":"Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API","description":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.","status":"published","published":"2026-10-30T19:53:29.214Z","modified":"2026-11-05T02:35:58.181Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-05T06:56:15.67765Z"}],"euvd":[{"id":"EUVD-2026-114377","description":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.","status":"published","published":"2026-10-30T19:53:29Z","modified":"2026-11-05T02:35:58Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-05T06:54:34.509968Z"}],"nvd":[{"id":"CVE-2026-119330","description":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.","status":"published","published":"2026-10-30T20:17:06.943Z","modified":"2026-11-05T03:17:19.49Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-05T06:56:49.198795Z"}],"osv":[{"id":"CVE-2026-119330","title":"Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API","description":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.","status":"published","published":"2026-10-30T19:53:29.214Z","modified":"2026-11-05T21:15:44.168579068Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-285"],"updated_at":"2026-11-05T22:01:21.792402Z"}]}}