CVE-2026-119330

The photo and video management solution Immich is vulnerable to an improper authorization issue in versions prior to 3.2.0 . The SharedLinkService.create() function in server/src/services/shared-link.service.ts failed to validate all input fields, allowing an authenticated attacker who knows a vi...

CVE-2026-119330 Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...

CVE-2026-119330 Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...