immich-exfiltration-demo

Cybersecurity demo: Immich exfiltration CVE-2026-35455 Proof-of-concept cybersecurity demo for CVE-2026-35455, showcasing automated API key generation and data exfiltration leading to full account hijacking and persistent unauthorized access. Learn more: report, video...

CVE-2026-108165

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...

EUVD-2026-96320

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...

CVE-2026-108165 Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...

CVE-2026-108165 Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...

CVE-2026-108165

Versions of Immich through 3.3.1 are vulnerable to a missing authorization flaw in the partner synchronization stream. The root cause is that synchronization queries fail to exclude Locked visibility, allowing authenticated partners to access Locked Folder asset metadata. An attacker with an acti...

CVE-2026-108165: Missing Authorization

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...

PT-2026-109651

Name of the Vulnerable Software and Affected Versions Immich versions prior to 3.3.2 Description A missing authorization issue exists in the partner synchronization stream. Authenticated partners can access metadata for assets within the Locked Folder because synchronization queries fail to exclu...

CVE-2026-105764

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764: Improper Control of Generation of Code

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

EUVD-2026-92868

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764

In versions prior to 3.2.4 , Immich (a self-hosted photo and video management solution) is vulnerable to Remote Code Execution (RCE) . An authenticated non-admin user can upload crafted SVG files that bypass the libvips native loader and fall through to ImageMagick coders. By using attacker-contr...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

PT-2026-106276

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-103532

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...

CVE-2026-103532 immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...

CVE-2026-103532

The immich-app Immich software, version up to 2.7.5 , is vulnerable to an improper authorization flaw. The issue resides in the Shared Link Preview Handler component, specifically within the checkSharedLinkAccess function of the server/src/utils/access.ts file. By manipulating the Password argume...

CVE-2026-103532 immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...