CVE-2026-82272highCWE-863

CVE-2026-82272: fallo de gravedad alta en immich-app immich

Immich Locked Assets Remain Readable Through Albums and Shared Links

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear immich

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.4%
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
immich-app · immich
CVEs relacionadas — immich-app immich

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-77439HIGHImmich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpointsEPSS 0.6%CVE-2026-25118MEDIUMimmich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared AlbumsEPSS 0.5%CVE-2026-59258HIGHimmich < 3.0.3 Shared Album Editor Ownership Takeover via updateUserEPSS 0.5%CVE-2026-119328MEDIUMImmich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning serviceEPSS 0.4%CVE-2025-43856HIGHimmich allows account hijacking through oauth2EPSS 0.4%CVE-2026-23896HIGHimmich API Key Privilege Escalation vulnerabilityEPSS 0.4%