Description

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T20:20:18.087Z",
  "pubdate": "2026-08-28T20:20:18.087Z",
  "executiveSummary": "Immich versions through 3.1.0 contain a significant access control vulnerability related to the handling of locked assets. This flaw manifests as an authorization bypass, where assets designated as 'locked' via the single-asset endpoint fail to enforce the expected visibility restrictions when accessed through shared albums or external links.\nThe vulnerability allows unauthorized entities—or authenticated users with access to a shared link—to view sensitive media files and their associated metadata despite the owner's attempt to restrict access. This represents a critical failure in the application's privilege management logic, specifically regarding the inheritance or override of object-level security policies.\nThe impact is significant, as it permits potential exposure of private, sensitive, or restricted user content to unintended parties. The vulnerability does not require complex exploit chains; it leverages existing, legitimate access vectors (shared albums) to circumvent intended privacy constraints. This flaw directly undermines the integrity of the platform's 'locked' state, posing a substantial risk to user privacy and data confidentiality across all Immich instances running the affected versions.",
  "technicalDetails": "The root cause of this vulnerability lies in an inconsistent authorization check implementation within the Immich backend. While the single-asset endpoint correctly handles the 'locked' state, the application logic governing shared album access and link-based resolution fails to perform a secondary validation against the locked status of individual assets included in those albums.\nWhen an asset is marked as locked, the application should theoretically exclude that resource from any broad inclusion manifests, such as shared albums or public share links. However, the system appears to treat these assets as persistently available to any context that has been granted blanket access to the parent album. The backend fails to verify the 'locked' bit during the retrieval process for shared album entities.\nThe attack flow is straightforward: 1) An attacker identifies an existing shared album or public link that contains an asset intended to be locked. 2) The attacker accesses the shared link, which the server resolves by fetching the album's associated asset IDs. 3) The server, failing to cross-reference the current 'locked' status of each asset against the current session or request context, serves the asset binary and its associated metadata (e.g., EXIF data, GPS coordinates) to the requestor.\nThe vulnerability is localized within the album and shared-link access controller logic, which lacks sufficient granularity in its security predicate. Because the authorization layer fails to propagate the locked status check down to the shared asset resolution phase, the intended security boundary is bypassed entirely. This flaw is present in all versions up to and including 3.1.0.\nExploitation requires no elevated privileges if a share link is already accessible to the attacker. The network exposure is defined by the availability of the Immich instance's share feature. Post-exploitation, an attacker can systematically harvest all media and metadata contained within shared albums, even if the assets within those albums have been explicitly locked by the owner to prevent such disclosure. The server treats the request as a legitimate retrieval operation for an album member, ignoring the security-critical metadata flag that should have triggered an access denied response."
}