immich CVE-2026-59258

The attacker must already hold editor-level access on a shared album belonging to the victim (PR:L) - i.e., the owner must have previously shared an album and granted the attacker the editor role. Exploitation targets the PUT /albums/:id/user/:userId member-role endpoint and requires two sequential API requests (demote owner, then self-promote). Limiting factors: it does not work against albums where the attacker is only a viewer, requires a valid authenticated session on the immich instance, affects only versions before 3.0.3, and is scoped to the specific album the attacker was invited to - not a server-wide compromise. No user interaction from the victim is needed once editor access exists.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H) rates this 7.2 (High): network-reachable, low complexity, no user interaction, but requiring low privileges - the attacker must already be an invited editor on a shared album. Integrity and availability impacts are High (attacker can seize control and delete/evict), confidentiality only Low. This is a genuine, easily automatable privilege-escalation issue with publicly available exploit code, which raises priority. However, exploitation is gated by a real precondition: the attacker needs an existing editor grant on a shared album, so this is not an unauthenticated internet-wide threat but rather an abuse-of-trust escalation among already-shared users. No EPSS score was supplied in the input, and the CVE is not indicated as CISA KEV, so there is no evidence of active in-the-wild exploitation - the elevated concern stems from POC availability, not observed attacks. Net: patch promptly on instances that use shared albums with non-trusted editors; lower urgency for single-user or fully-trusted deployments.

An attacker is invited as an editor to a victim's shared album. Using the documented PUT /albums/:id/user/:userId behavior, they send one request demoting the album owner to editor, then a second request promoting their own account to owner - after which they can delete the album, evict the original owner, and control all shared assets. Publicly available exploit code demonstrates this low-complexity, network-based sequence requiring no user interaction.