{"affected":[{"product":"immich","source":"CNA: GitHub_M","vendor":"immich-app","versions":[{"status":"affected","version":"< 3.2.0"}]}],"cveId":"CVE-2026-119330","cwes":["CWE-285"],"description":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.","epss":{"date":"2026-11-04","percentile":0.1289,"score":0.00222},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93"}],"kev":null,"metrics":[{"score":3.5,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793846158181,"publishedAt":1793390009214,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/immich-app/immich/pull/30762"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/immich-app/immich/commit/6a61901e79972bbfe5690636a995e156219b9a8f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/immich-app/immich/releases/tag/v3.2.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93"}],"remediation":[],"revision":"1e9c55d4f2b04c68d57744930d4f5710ebdce8af065469527092474133441665","sources":[{"modifiedAt":1793846158181,"name":"CNA: GitHub_M","retrievedAt":1793848121339,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119330"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793848155330,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-119330"}],"ssvc":{"assessedAt":1793846135742,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API","updatedAt":1793848155330}