Is CVE-2026-103532 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103532 being exploited in the wild.

How severe is CVE-2026-103532?

Medium severity, with a CVSS score of 5.3, published 1 October 2026.

How is CVE-2026-103532 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-103532?

Check whether you run Immich-App Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103532: Immich shared link password bypass in access control

CVE-2026-103532 · Severity: medium · CVSS 5.3 · Published 2026-10-01

Immich is a self-hosted photo and video management system that allows users to share media via password-protected links. A flaw in the authorization logic allows attackers to bypass password protection and access thumbnails and full metadata (including GPS location and EXIF data) by simply knowing the shared link URL, without entering the correct password. This exposes sensitive information about photos and their locations to unauthorized viewers.

Vendors: Immich-App.

Quick answers

Is CVE-2026-103532 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103532 being exploited in the wild.
How severe is CVE-2026-103532?: Medium severity, with a CVSS score of 5.3, published 1 October 2026.
Which products and versions are affected?: Immich-App Immich up to 2.7.5.
Is there a fix for CVE-2026-103532?: No fixed version is recorded yet. Restrict access to the Immich server from untrusted networks, or enforce the shared link password check in the checkSharedLinkAccess() function before granting AssetRead and AssetView permissions. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103532 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-103532?: Check whether you run Immich-App Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict access to the Immich server from untrusted networks, or enforce the shared link password check in the checkSharedLinkAccess() function before granting AssetRead and AssetView permissions.

Technical details

The vulnerability is an improper authorization flaw in the checkSharedLinkAccess() function in server/src/utils/access.ts that grants AssetRead and AssetView permissions based only on whether an asset belongs to a shared link, but fails to check whether the link's password requirement has been satisfied. The password validation logic exists only in SharedLinkService.getMine() and login(), leaving asset and album endpoints unguarded. An attacker can retrieve thumbnails and metadata via GET requests to /api/assets/:id/thumbnail and /api/assets/:id endpoints using only the shared link key parameter, bypassing password authentication entirely.

Affected products

immich-app Immich up to 2.7.5

Timeline

2026-07-05: disclosed: Reported via GitHub issue #29599
2026-10-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.