Vulnerability details

CVE-2026-77439

immich-app Immich

Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints

CVSS 3.1

8.8High

Official description

Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.

CVSS scores

Score	Version	Source	Vector
8.8High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
immich-app	Immich	< 3.0.3	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/immich-app/immich/security/advisories/GHSA-c9mf-h82r-8p4j x_refsource_CONFIRM
https://github.com/immich-app/immich/pull/29883 x_refsource_MISC
https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960 x_refsource_MISC
https://github.com/immich-app/immich/releases/tag/v3.0.3 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-05
Last updated: 2026-11-05
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.6%

Probability of exploitation in 30 days

48.9%

Percentile (among all CVEs)

Weaknesses (CWE)

CWE-269
Improper Privilege Management
CWE-639
Authorization Bypass Through User-Controlled Key