PT-2026-103656 · Immich · Immich
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Immich versions prior to 2.7.6
Description
Improper authorization occurs in the Shared Link Preview Handler component within the
checkSharedLinkAccess() function located in server/src/utils/access.ts. A remote attacker can exploit this by manipulating the Password argument to bypass authorization controls.Recommendations
Update to version 2.7.6 or later.
As a temporary mitigation, restrict access to the Shared Link Preview Handler functionality.
Exploit
Fix
Incorrect Privilege Assignment
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Immich