CVE-2026-77439

Immich is vulnerable to broken access control in its album member management system prior to version 3.0.3 . An authenticated user with Editor access to a shared album can perform a complete album takeover by exploiting two related flaws: Privilege Escalation via the PATCH /api/albums/:albumId/us...

CVE-2026-77439 Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints

Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting...

CVE-2026-59258 immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owne...

CVE-2026-59258 immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owne...