---
id: CVE-2026-104867
title: >-
  Immich calendar heatmap endpoint discloses cross-user activity through broken
  access control
summary: >-
  Immich is a high-performance self-hosted photo and video management solution.
  From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route
  in server/src/controllers/user-admin.controller.ts uses the ordinary
  Permission.Us…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-284
  - CWE-639
  - CWE-1220
vendor: immich-app
product: immich
affected:
  - 'immich >= 3.0.0, < 3.2.0'
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T18:31:48.319174Z'
exploitAvailable: true
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T18:34:02.825Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104867'
references:
  - url: >-
      https://github.com/immich-app/immich/security/advisories/GHSA-g82p-27g4-864h
    label: >-
      https://github.com/immich-app/immich/security/advisories/GHSA-g82p-27g4-864h
  - url: 'https://github.com/immich-app/immich/pull/30310'
    label: 'https://github.com/immich-app/immich/pull/30310'
  - url: >-
      https://github.com/immich-app/immich/commit/6c86d39f6d9955fc5e2998ce808e6f794b5ebd5e
    label: >-
      https://github.com/immich-app/immich/commit/6c86d39f6d9955fc5e2998ce808e6f794b5ebd5e
  - url: >-
      https://github.com/immich-app/immich/commit/f68815e35f4677dbc3a8ff58a7402952672dfceb
    label: >-
      https://github.com/immich-app/immich/commit/f68815e35f4677dbc3a8ff58a7402952672dfceb
  - url: 'https://github.com/immich-app/immich/releases/tag/v3.2.0'
    label: 'https://github.com/immich-app/immich/releases/tag/v3.2.0'
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-11-05T22:38:31.471Z'
---

## Overview

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and UserAdminService.getCalendarHeatmap in server/src/services/user-admin.service.ts does not compare the authenticated user with the requested user identifier or perform a separate access check. Any authenticated non-admin user can therefore request another account's upload or capture-date activity heatmap for an arbitrary date range. AssetRepository.getCalendarHeatmap in server/src/repositories/asset.repository.ts filters by owner, date, and deletion state but not visibility, so the returned daily counts and total count include archived and locked assets. The route exposes counts and activity dates but does not return asset metadata or content, and it does not affect integrity or availability. This issue is fixed in version 3.2.0.

## Affected

- `immich >= 3.0.0, < 3.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.