Quick answers
- Is CVE-2026-82272 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82272 being exploited in the wild.
- How severe is CVE-2026-82272?
- Medium severity, with a CVSS score of 6.5, published 28 August 2026.
- Which products and versions are affected?
- Immich through 3.1.0.
- Is there a fix for CVE-2026-82272?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82272 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82272?
- Check whether you run Immich at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an access control bypass in Immich through version 3.1.0 affecting the single-asset endpoint. When assets are locked through this endpoint, the locked visibility restriction is not properly enforced for assets already included in shared albums or public links. An unauthenticated attacker can access these locked assets by using any previously-created shared album or link, reading both the asset files and associated metadata. The issue occurs because the access control logic fails to check asset lock status when serving content through shared access paths.
Affected products
- Immich Immich through 3.1.0
Timeline
- 2026-08-28: disclosed