CVE-2026-104867

The Immich photo and video management solution is vulnerable to a broken access control issue in versions 3.0.0 through 3.2.0 . The GET /api/admin/users/{id}/calendar-heatmap route incorrectly uses the Permission.UserRead permission without an admin-route requirement. Furthermore, the UserAdminSe...