CVE-2026-77439
Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.
| CWE | CWE-269 CWE-639 |
| Vendor | immich-app |
| Product | immich |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for immich-app immich
Be the first to know when new high vulnerabilities affecting immich-app immich are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
immich-app / immich
< 3.0.3
References
github.com: https://github.com/immich-app/immich/security/advisories/GHSA-c9mf-h82r-8p4j github.com: https://github.com/immich-app/immich/pull/29883 github.com: https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960 github.com: https://github.com/immich-app/immich/releases/tag/v3.0.3