immich -- locked assets remain accessible through shared albums and links

NVD reports:

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links.

[source]

The single-asset code path still lacks the album removal that the bulk path performs, so 3.2.0 is affected as well. Upstream has not released a fix yet.