EUVD-2026-44755
GHSA-mxpm-jvrh-gcj5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint reachable with low complexity, but attacker needs existing editor grant (PR:L); ownership seizure plus deletion/eviction yields high integrity and availability, low confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.
AnalysisAI
Album ownership takeover in immich before 3.0.3 allows a user with shared-album editor access to escalate to full owner by abusing the PUT /albums/:id/user/:userId endpoint (CWE-863, Incorrect Authorization). Because the endpoint fails to enforce owner-only restrictions on role changes, an editor can demote the legitimate owner and promote themselves across two sequential requests, gaining deletion and member-eviction control over the album and its assets. Publicly available exploit code exists and a vendor patch (v3.0.3) has shipped, though it is not currently listed in CISA KEV.
Technical ContextAI
immich is a self-hosted photo and video management platform. The flaw lives in its album-sharing authorization model: the album member-management API (PUT /albums/:id/user/:userId) accepts role updates without verifying that the requester holds the owner role, so any shared user with editor privileges can alter any member's role - including the owner's. This is a classic CWE-863 Incorrect Authorization: the endpoint authenticates the caller and confirms album membership but omits the object-level check that only the owner may reassign ownership. The affected component is identified by CPE cpe:2.3:a:immich-app:immich (all versions prior to the fix). The upstream remediation, PR #29883 titled 'fix: unauthorized album owner update', adds the missing owner-only enforcement.
RemediationAI
Vendor-released patch: upgrade immich to v3.0.3 or later (https://github.com/immich-app/immich/releases/tag/v3.0.3), which merges the owner-only enforcement fix in PR #29883 (commit 84dff19ca9a467752d848ff54763d62c04ebf960). This is the primary and complete fix. If immediate upgrade is not possible, reduce exposure by restricting shared albums to trusted editors only - grant viewer (read-only) rather than editor rights to non-trusted collaborators, since the flaw requires editor access to trigger; note this trade-off removes legitimate editors' ability to contribute assets. On instances exposed beyond a trusted user base, limiting or disabling album sharing until patched removes the attack surface at the cost of the sharing feature. Monitor album membership/role-change activity for unexpected owner reassignments as a detective control.
Immich versions prior to 2.5.0 contain an improper access control flaw that allows any authenticated API key to escalate
Reflected cross-site scripting in Immich (commits 4ffa26c9 through pre-4eb1003) allows a single-click account takeover o
Locked asset visibility bypass in Immich through 3.1.0 exposes private photo and video assets to unauthorized viewers vi
Immich prior to version 2.6.0 discloses shared album passwords in cleartext within URL query parameters during authentic
Stored Cross-Site Scripting in Immich photo management platform versions prior to 2.7.0 enables authenticated attackers
Open redirect vulnerability in Immich prior to version 2.7.3 allows authenticated attackers to craft malicious shared al
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today