---
id: CVE-2026-119330
title: >-
  Immich: A regular user can create SharedLink for album/asset belonging to
  another user through CreateSharedLink API
summary: >-
  Immich is a high-performance self-hosted photo and video management solution.
  Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as
  independent fields in server/src/services/shared-link.service.ts but
  authorized o…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-285
vendor: immich-app
product: immich
affected:
  - immich < 3.2.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T02:35:35.742916Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:35:58.181Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119330'
references:
  - url: >-
      https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93
    label: >-
      https://github.com/immich-app/immich/security/advisories/GHSA-g4w3-c888-cr93
  - url: 'https://github.com/immich-app/immich/pull/30762'
    label: 'https://github.com/immich-app/immich/pull/30762'
  - url: >-
      https://github.com/immich-app/immich/commit/6a61901e79972bbfe5690636a995e156219b9a8f
    label: >-
      https://github.com/immich-app/immich/commit/6a61901e79972bbfe5690636a995e156219b9a8f
  - url: 'https://github.com/immich-app/immich/releases/tag/v3.2.0'
    label: 'https://github.com/immich-app/immich/releases/tag/v3.2.0'
tags:
  - cve.org
  - exploit-available
epss: 0.00222
epssPercentile: 0.1289
ingestedAt: '2026-11-05T21:36:00.694Z'
---

## Overview

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An authenticated attacker who already knew a victim-owned asset UUID could select SharedLinkType.Album for an attacker-owned album while supplying that UUID in assetIds; SharedLinkService.create() persisted the unchecked association in shared_link_asset and made the victim asset available through the new anonymous shared-link credential. This exposed victim metadata, thumbnails, and the byte-identical original file and created a persistent sharing relationship that could be redistributed. This issue is fixed in version 3.2.0.

## Affected

- `immich < 3.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.