CVE Feed

    Dashboard / CVE / CVE-2026-77439

    CVE-2026-77439

    Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.

    Published:Nov 5, 2026
    Last Modified:Nov 5, 2026
    EPS:Nov 5, 2026
    EPSS Score:
    CVSS Score:8.8

    Affected Products

    Vendor
    Immich-app
    Product
    Immich

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-104867 (CVSS 4.3) — Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET …
    CVE-2026-119330 (CVSS 3.5) — Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link …
    CVE-2026-119329 (CVSS 4.3) — Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/mar…
    CVE-2026-119328 (CVSS 6.5) — Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthentica…
    CVE-2026-105764 (CVSS 7.7) — Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated…
    CVE-2026-82272 (CVSS 7.1) — Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the sing…
    CVE-2026-59258 (CVSS 7.2) — immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoin…
    CVE-2026-53662 (CVSS 9.6) — immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb10…
    CVE-2026-40096 (CVSS 5.1) — immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain …
    CVE-2026-35455 (CVSS 7.3) — immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Si…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High