PT-2026-103656

CVE-2026-103532

Published

2026-10-01

Updated

2026-10-01

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X

Name of the Vulnerable Software and Affected Versions Immich versions prior to 2.7.6

Description Improper authorization occurs in the Shared Link Preview Handler component within the checkSharedLinkAccess() function located in server/src/utils/access.ts. A remote attacker can exploit this by manipulating the Password argument to bypass authorization controls.

Recommendations Update to version 2.7.6 or later. As a temporary mitigation, restrict access to the Shared Link Preview Handler functionality.

Exploitability

Exploit

Fix

Impacts

Researchers

Geochen

Vendors

Affected products

Weakness enumeration

CWE-285: Improper Authorization

CWE-266: Incorrect Privilege Assignment