CVE-2026-77439

    Dashboard / Vulnerabilities / CVE-2026-77439

    CVE-2026-77439

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints

    Details: Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.

    References: https://github.com/immich-app/immich/releases/tag/v3.0.3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77439.json, https://github.com/immich-app/immich/security/advisories/GHSA-c9mf-h82r-8p4j, https://nvd.nist.gov/vuln/detail/CVE-2026-77439, https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960, https://github.com/immich-app/immich/pull/29883

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -cd308ad93093735135f99d85ce6980c8e93df231

    Affected versions

    v3.0.2
    v3.0.1
    v3.0.0
    v3.0.0-rc.4
    v3.0.0-rc.3
    v3.0.0-rc.2
    v3.0.0-rc.1
    v3.0.0-rc.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-77439 | CVE-DB