This vulnerability affects immich-app Immich up to version 2.7.5 in the checkSharedLinkAccess function of server/src/utils/access.ts, specifically in the Shared Link Preview Handler component. Improper authorization occurs due to manipulation of the Password argument, potentially allowing unauthorized remote access. The CVSS 4.0 base score is 6.9, indicating a medium severity level. The vulnerability has been publicly disclosed but no known exploits are reported in the wild. The GitHub issue tracking this was closed as a duplicate, and no vendor advisory or patch information is available.

An attacker can remotely exploit this vulnerability by manipulating the Password argument to bypass authorization checks in the Shared Link Preview Handler. This may allow unauthorized access to shared link previews or related resources. The impact is limited to improper authorization without evidence of privilege escalation or data integrity compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor immich-app's official channels for updates. Until a fix is available, restrict access to shared links where possible and consider additional access controls as a temporary measure.