Files
immich/server
timonrieger 81b8d896b5 fix(server): replace album user-not-found message to prevent UUID-existence oracle
Album owners could probe arbitrary UUIDs via the add-user endpoint and
determine whether they belonged to registered accounts by receiving
'User not found'. The message is now ambiguous about whether the ID was
unrecognised or the user is inactive.
2026-04-30 11:54:00 +02:00
..