CVE-2026-103532

EUVD-2026-90451
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label "duplicate".
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/immich-app/immich/
https://github.com/immich-app/immich/issues/29599
https://vuldb.com/cve/CVE-2026-103532
https://vuldb.com/submit/957120
https://vuldb.com/vuln/412344
https://vuldb.com/vuln/412344/cti
https://github.com/immich-app/immich/issues/29599