Vulnerabilities

TI-2026-85531 CVE-2026-77439

Immich album editors can take over albums and remove the owner

LOW 39

Immich is a self-hosted photo and video management solution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.006 Published 2026-11-05 Fixed in 3.0.3 CWE-269

TI-2026-85528 CVE-2026-104867

Immich calendar heatmap exposes other users' activity via broken access control

MEDIUM 53

Immich is a high-performance self-hosted photo and video management solution.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00311 Published 2026-11-05 Fixed in 3.2.0 CWE-1220

TI-2026-83369 CVE-2026-119330

Improper authorization in Immich lets users share other users' assets

MEDIUM 50

Immich is a high-performance self-hosted photo and video management solution.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00222 Published 2026-10-30 Fixed in 3.2.0 CWE-285

TI-2026-83368 CVE-2026-119329

Immich leaks archived asset GPS data to view-only partners

MEDIUM 53

Immich is a high-performance self-hosted photo and video management solution.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-10-30 Fixed in 3.0.0 CWE-639

TI-2026-83367 CVE-2026-119328

Unauthenticated path injection in Immich machine-learning service

HIGH 68

Immich is a high-performance self-hosted photo and video management solution.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00436 Published 2026-10-30 Fixed in 3.3.0 CWE-22

TI-2026-70533 CVE-2026-108165 · GHSA-4jh4-m6r3-369v

Missing authorization in Immich partner sync exposes Locked Folder metadata

LOW 23

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00199 Published 2026-10-10 No fix listed CWE-862

TI-2026-68375 CVE-2026-105764

Code injection in Immich lets authenticated users run code via SVG

HIGH 69

Immich is a high-performance self-hosted photo and video management solution.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.0034 Published 2026-10-05 Fixed in 3.2.4 CWE-94

TI-2026-65721 CVE-2026-103532 · GHSA-pr8c-q9fw-jxc3

immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

HIGH 70

A vulnerability has been found in immich-app Immich up to 2.7.5.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00391 Published 2026-10-01 No fix listed CWE-266

TI-2026-56737 CVE-2026-82272 · GHSA-7r4r-rw6m-57g4

Immich Locked Assets Remain Readable Through Albums and Shared Links

LOW 32

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00436 Published 2026-08-28 No fix listed CWE-863

TI-2026-42398 CVE-2026-59258 · GHSA-mxpm-jvrh-gcj5

immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

HIGH 65

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00456 Published 2026-07-15 Fixed in 3.0.3 CWE-863

TI-2026-38703 CVE-2026-53662