CVE-2026-104867

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...

EUVD-2026-117603

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...

CVE-2026-104867

The admin route "GET /api/admin/users/id/calendar-heatmap" is declared with "@Authenticated permission: Permission.UserRead " instead of "@Authenticated permission: Permission.AdminUserRead, admin: true ", and the service method behind it performs no ownership or role check. Every other endpoint ...