immich -- locked assets remain accessible through shared albums and links

2026-09-11 · CVE-2026-82272 · VuXML entry

VulnCheck reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. In 3.2.2 the single-asset endpoint still lacks the album removal that the bulk endpoint performs, and the album and shared link access checks still carry no visibility filter. Both code paths of the web …

Affected versions

• immich <= 3.2.2

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.