CVE-2026-119330

Name of the Vulnerable Software and Affected Versions Immich versions prior to 3.2.0

Description The shared-link creation API in the server/src/services/shared-link.service.ts file allows an authenticated attacker to expose assets belonging to other users. By selecting SharedLinkType.Album for an album they own while providing a victim's asset UUID in the assetIds parameter, the SharedLinkService.create() function persists this unchecked association. This results in the victim's metadata, thumbnails, and original files becoming accessible via an anonymous shared-link credential.

Recommendations Update to version 3.2.0.