CVE-2026-82272

Immich through version 3.1.0 contains an incorrect-authorization flaw (CWE-863) in which the locked-asset visibility control is not enforced when locked assets are also present in shared albums or shared links. The condition arises when a user locks assets via the single-asset endpoint, but those assets remain members of albums or links that have already been shared. Anyone with access to such a share - the CVSS vector indicates low privileges, e.g. a share recipient or holder of a shared link - can read the locked assets and their metadata, bypassing the lock; confidentiality is affected while integrity and availability are not. All self-hosted Immich deployments up to and including 3.1.0 are affected, but only where the locked-asset feature overlaps with existing shared albums or links. No public proof of concept, KEV listing, or known in-the-wild exploitation exists; EPSS estimates the 30-day exploitation probability at about 0.3%.

What to do: Upgrade to an Immich release newer than 3.1.0 once a patched version is published; no fixed version is specified in the available data. As an interim mitigation, remove locked assets from shared albums or shared links, or revoke/restrict those shares, until you can patch. Verify whether your instance actually uses the locked-asset feature, since the flaw only matters when locked assets appear in existing shares.