CVE-2026-104867

The Immich photo and video management solution is vulnerable to a broken access control issue in versions 3.0.0 through 3.2.0 . The GET /api/admin/users/{id}/calendar-heatmap route incorrectly uses the Permission.UserRead permission without an admin-route requirement. Furthermore, the UserAdminSe...

CVE-2026-104867 Immich calendar heatmap endpoint discloses cross-user activity through broken access control

Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/id/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route requirement, and...