{"id":"CVE-2026-103532","state":"PUBLISHED","title":"immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization","description":"A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label \"duplicate\".","publishedAt":"2026-10-01T01:15:17.384Z","updatedAt":"2026-10-01T18:58:33.513Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X","source":"VulDB"},"assigner":"VulDB","products":["immich-app Immich"],"affected":[{"vendor":"immich-app","product":"Immich","versions":[{"version":"2.7.0","status":"affected"},{"version":"2.7.1","status":"affected"},{"version":"2.7.2","status":"affected"},{"version":"2.7.3","status":"affected"},{"version":"2.7.4","status":"affected"},{"version":"2.7.5","status":"affected"}],"cpes":["cpe:2.3:a:immich:immich:*:*:*:*:*:*:*:*"],"modules":["Shared Link Preview Handler"]}],"references":["https://vuldb.com/vuln/412344","https://vuldb.com/vuln/412344/cti","https://vuldb.com/cve/CVE-2026-103532","https://vuldb.com/submit/957120","https://github.com/immich-app/immich/issues/29599","https://github.com/immich-app/immich/"],"weaknesses":["CWE-285","CWE-266"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/103xxx/CVE-2026-103532.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-103532","state":"PUBLISHED","datePublished":"2026-10-01T01:15:17.384Z","dateUpdated":"2026-10-01T18:58:33.513Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-30T19:06:55.475Z"},"containers":{"cna":{"title":"immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization","descriptions":[{"lang":"en","value":"A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label \"duplicate\"."}],"affected":[{"vendor":"immich-app","product":"Immich","versions":[{"version":"2.7.0","status":"affected"},{"version":"2.7.1","status":"affected"},{"version":"2.7.2","status":"affected"},{"version":"2.7.3","status":"affected"},{"version":"2.7.4","status":"affected"},{"version":"2.7.5","status":"affected"}],"cpes":["cpe:2.3:a:immich:immich:*:*:*:*:*:*:*:*"],"modules":["Shared Link Preview Handler"]}],"references":[{"url":"https://vuldb.com/vuln/412344","name":"VDB-412344 | immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/412344/cti","name":"VDB-412344 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-103532","name":"CVE-2026-103532 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/957120","name":"Submit #957120 | https://github.com/immich-app immich v2.7.5 Missing Authorization","tags":["third-party-advisory"]},{"url":"https://github.com/immich-app/immich/issues/29599","tags":["issue-tracking"]},{"url":"https://github.com/immich-app/immich/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","type":"CWE","lang":"en","description":"Improper Authorization"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-10-01T01:15:17.384Z"},"timeline":[{"time":"2026-09-30T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-30T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-09-30T21:12:03.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"geochen (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202610"]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/immich-app/immich/issues/29599","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-01T18:58:15.324035Z","id":"CVE-2026-103532","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-01T18:58:33.513Z"}}]}}}