CVE-2026-77439

Immich is vulnerable to broken access control in its album member management system prior to version 3.0.3 . An authenticated user with Editor access to a shared album can perform a complete album takeover by exploiting two related flaws: Privilege Escalation via the PATCH /api/albums/:albumId/us...