immich-exfiltration-demo

Cybersecurity demo: Immich exfiltration CVE-2026-35455 Proof-of-concept cybersecurity demo for CVE-2026-35455, showcasing automated API key generation and data exfiltration leading to full account hijacking and persistent unauthorized access. Learn more: report, video...

CVE-2026-77439

Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting...

CVE-2026-77439

Immich is vulnerable to broken access control in its album member management system prior to version 3.0.3 . An authenticated user with Editor access to a shared album can perform a complete album takeover by exploiting two related flaws: Privilege Escalation via the PATCH /api/albums/:albumId/us...

CVE-2026-77439 Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints

Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting...

CVE-2026-77439 Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints

Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting...

CVE-2026-104867

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...

EUVD-2026-117603

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...

CVE-2026-104867

The Immich photo and video management solution is vulnerable to a broken access control issue in versions 3.0.0 through 3.2.0 . The GET /api/admin/users/{id}/calendar-heatmap route incorrectly uses the Permission.UserRead permission without an admin-route requirement. Furthermore, the UserAdminSe...

CVE-2026-104867 Immich calendar heatmap endpoint discloses cross-user activity through broken access control

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...

CVE-2026-104867 Immich calendar heatmap endpoint discloses cross-user activity through broken access control

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...

Immich permission and access control issue vulnerability

A security vulnerability exists in Immich versions 3.0.0 through 3.2.0. This vulnerability stems from improper permission checks during calendar heatmap routing; it fails to compare the identity of authenticated users with that of the requesting user, and does not apply asset visibility filters. ...

CVE-2026-119329

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every...

CVE-2026-119330

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...

CVE-2026-119328

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immichml/main.py accepted an options object and passed its values into model construction in...

CVE-2026-119330

The photo and video management solution Immich is vulnerable to an improper authorization issue in versions prior to 3.2.0 . The SharedLinkService.create() function in server/src/services/shared-link.service.ts failed to validate all input fields, allowing an authenticated attacker who knows a vi...

EUVD-2026-114377

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...

CVE-2026-119330 Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...

CVE-2026-119330 Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...

CVE-2026-119329 Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every...

CVE-2026-119329 Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every...