WS-2022-0347

Full Account Takeover via Improper Authorization in immich-app/immich. Immich does not check for admin privileges when setting account passwords. This allows any user to set the password for any account, thus allowing privilege escalation by admin account takeover...