Immich album editors can take over albums and remove the owner
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269 and CWE-639.
Summary
Immich before 3.0.3 lets an authenticated user with editor access to a shared album change the role of the album owner, because album member role updates do not protect the owner. An editor can demote the owner, promote themselves, and then remove the original owner and delete the album. The flaw is an improper privilege management issue (CWE-269) and is exploitable by a remote user with low privileges.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| immich-app | immich | before 3.0.3 | 3.0.3 | Patch available | CNA |
- immich Vendorimmich-app Affected before 3.0.3 Fixed in 3.0.3 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:futo:immich:*:*:*:*:*:*:*:* | — | — | immich-app |
- cpe:2.3:a:futo:immich:*:*:*:*:*:*:*:* Versions — — ·immich-app
Remediation
Update Immich to version 3.0.3, which fixes the flaw. The sources list no fixed version for any other Immich release line.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA immich (immich-app) Fixed in 3.0.3
Timeline
- 2026-11-05 Threatist record created from CVE-2026-77439
- 2026-11-07 Priority changed: MEDIUM → LOW
References
More immich-app vulnerabilities
- TI-2026-38703 immich: One-click account takeover via XSS in login page continue redirect CVSS 3.1CRITICAL 9.6
- TI-2026-19252 immich API Key Privilege Escalation vulnerability CVSS 3.1HIGH 8.8
- TI-2026-65721 immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization CVSS 4.0MEDIUM 6.9
- TI-2026-68375 Code injection in Immich lets authenticated users run code via SVG CVSS 4.0HIGH 7.7
- TI-2026-83367 Unauthenticated path injection in Immich machine-learning service CVSS 3.1MEDIUM 6.5
- TI-2025-28440 immich allows account hijacking through oauth2 CVSS 4.0HIGH 7.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences