immich-app

Records16All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

immich-app records in CISA KEV

No immich-app vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Immich 4 records HIGH

Records

16 records

TI-2026-38703 CVE-2026-53662

immich: One-click account takeover via XSS in login page continue redirect

HIGH 76

immich is a high performance self-hosted photo and video management solution.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00298 Published 2026-06-23 No fix listed CWE-601

TI-2026-19252 CVE-2026-23896

immich API Key Privilege Escalation vulnerability

HIGH 73

immich is a high performance self-hosted photo and video management solution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00352 Published 2026-01-29 Fixed in 2.5.0 CWE-269

TI-2026-65721 CVE-2026-103532 · GHSA-pr8c-q9fw-jxc3

immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

HIGH 70

A vulnerability has been found in immich-app Immich up to 2.7.5.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00391 Published 2026-10-01 No fix listed CWE-266

TI-2026-68375 CVE-2026-105764

Code injection in Immich lets authenticated users run code via SVG

HIGH 69

Immich is a high-performance self-hosted photo and video management solution.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.0034 Published 2026-10-05 Fixed in 3.2.4 CWE-94

TI-2026-83367 CVE-2026-119328

Unauthenticated path injection in Immich machine-learning service

HIGH 68

Immich is a high-performance self-hosted photo and video management solution.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00436 Published 2026-10-30 Fixed in 3.3.0 CWE-22

TI-2025-28440 CVE-2025-43856

immich allows account hijacking through oauth2

HIGH 67

immich is a high performance self-hosted photo and video management solution.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00435 Published 2025-07-11 Fixed in 1.132.0 CWE-303

TI-2026-42398 CVE-2026-59258 · GHSA-mxpm-jvrh-gcj5

immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

HIGH 65

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00456 Published 2026-07-15 Fixed in 3.0.3 CWE-863

TI-2026-20281 CVE-2026-25118

immich-server: Insecure Transmission of Authentication Credentials via Password Parameter…

MEDIUM 61

immich is a high performance self-hosted photo and video management solution.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00467 Published 2026-04-03 Fixed in 2.6.0 CWE-598

TI-2026-28923 CVE-2026-40096

immich: Open Redirect via Shared Album name

MEDIUM 56

immich is a high performance self-hosted photo and video management solution.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-04-14 Fixed in 2.7.3 CWE-601

TI-2026-85528 CVE-2026-104867

Immich calendar heatmap exposes other users' activity via broken access control

MEDIUM 53

Immich is a high-performance self-hosted photo and video management solution.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00311 Published 2026-11-05 Fixed in 3.2.0 CWE-1220

TI-2026-83368 CVE-2026-119329

Immich leaks archived asset GPS data to view-only partners

MEDIUM 53

Immich is a high-performance self-hosted photo and video management solution.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-10-30 Fixed in 3.0.0 CWE-639

TI-2026-83369 CVE-2026-119330

Improper authorization in Immich lets users share other users' assets

MEDIUM 50

Immich is a high-performance self-hosted photo and video management solution.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00222 Published 2026-10-30 Fixed in 3.2.0 CWE-285

TI-2026-85531 CVE-2026-77439

Immich album editors can take over albums and remove the owner

LOW 39

Immich is a self-hosted photo and video management solution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.006 Published 2026-11-05 Fixed in 3.0.3 CWE-269

TI-2026-27586 CVE-2026-35455

immich has Stored XSS via OCR Text in 360° Panorama Viewer

LOW 33

immich is a high performance self-hosted photo and video management solution.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00229 Published 2026-04-08 Fixed in 2.7.0 CWE-79

TI-2026-56737 CVE-2026-82272 · GHSA-7r4r-rw6m-57g4

Immich Locked Assets Remain Readable Through Albums and Shared Links

LOW 32

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00436 Published 2026-08-28 No fix listed CWE-863

TI-2026-70533 CVE-2026-108165 · GHSA-4jh4-m6r3-369v

Missing authorization in Immich partner sync exposes Locked Folder metadata

LOW 23

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00199 Published 2026-10-10 No fix listed CWE-862

Open these records in search →

Critical	1
High	7
Medium	7
Low	1
No CVSS	0