CVE-2026-77439High· 8.8▾ TwilightImmich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.
immich < 3.0.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59258High· 8.3immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions
CVE-2026-104867Medium· 4.3Immich calendar heatmap endpoint discloses cross-user activity through broken access control
CVE-2026-119329Medium· 4.3Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers
CVE-2026-119330Low· 3.5Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
CVE-2026-119328Medium· 6.5Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service
CVE-2026-108165Medium· 4.3Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility