CVE-2026-119330 | immich-app Immich up to 3.1.x Shared Link Creation API shared-link.service.ts SharedLinkService.create albumId/assetIds improper authorization

October 30, 2026 Yanac

A vulnerability has been found in immich-app Immich up to 3.1.x and classified as problematic. This vulnerability affects the function SharedLinkService.create of the file server/src/services/shared-link.service.ts of the component Shared Link Creation API. This manipulation of the argument albumId/assetIds causes improper authorization.

This vulnerability is registered as CVE-2026-119330. Remote exploitation of the attack is possible. No exploit is available.

The affected component should be upgraded.VulDB Recent EntriesRead More