CVE-2026-82272 immich-app CVE debrief

Who should care

Defenders responsible for Immich deployments should assess exposure and verify asset locking configurations to prevent unauthorized asset access. This includes reviewing shared album and link permissions, monitoring for unauthorized asset access, and ensuring locked assets are not accessible through unintended channels. Security teams should prioritize verifying Immich asset locking and shared album configurations to prevent potential unauthorized asset

Why it matters

Defenders should prioritize verifying Immich asset locking and shared album configurations to prevent unauthorized asset access.

• Potential unauthorized asset access
• Bypassing locked visibility protection
• Reading locked assets and metadata

Technical summary

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. This enables attackers to read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection. The vulnerability highlights the importance of verifying Immich asset locking and shared album configurations to prevent unauthorized asset access. Defenders should prioritize verifying these configurations to ensure locked assets are not accessible through unintended channels.

Defensive priority

Defenders should prioritize verifying Immich asset locking and shared album configurations.

Recommended defensive actions

• Verify Immich asset locking configurations
• Review shared album and link permissions
• Monitor for unauthorized asset access
• Confirm whether affected Immich deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the Immich locked asset visibility bypass vulnerability. The vulnerability allows attackers to access locked assets through shared albums or links. Evidence is limited to public CVE and NVD records, which may not cover all affected deployments or configurations. Defenders should verify Immich asset locking and shared album configurations to ensure locked assets are not accessible through unintended channels.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.