CVE-2026-82272: Immich Locked Assets Remain Readable Through Albums and Shared Links
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection.
Affected Software
Event History
Frequently Asked Questions
Who can access a locked asset under this issue?
Anyone who can access an existing shared album or shared link containing the asset may be able to read the locked asset and its metadata. Exploitation requires access to such a sharing mechanism; no user interaction is required.
Which locking workflow is affected?
The issue applies when an asset is locked through the single-asset endpoint. The provided information does not establish whether assets locked through other workflows are affected.
What should be reviewed if upgrading is not immediately possible?
Review existing shared albums and links for assets that were locked through the single-asset endpoint, because those sharing paths can continue to expose the assets and their metadata. Restrict or remove access to relevant shared albums or links until the visibility protection is enforced.
How can I determine whether my deployment is in scope?
Immich through version 3.1.0 is affected. Check whether your deployment has assets locked through the single-asset endpoint that are also present in existing shared albums or accessible through shared links.