{"id":"CVE-2026-59258","title":"immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions","summary":"immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can dem…","severity":"high","cvss":8.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","cwe":["CWE-863"],"vendor":"immich-app","product":"immich","affected":["immich < 3.0.3"],"published":"2026-07-15","updated":"2026-09-17","sourceUpdated":"2026-09-17T18:16:53.750","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59258","references":[{"url":"https://github.com/immich-app/immich/commit/84dff19ca9a467752d848ff54763d62c04ebf960","label":"disclosure@vulncheck.com"},{"url":"https://github.com/immich-app/immich/issues/29857","label":"disclosure@vulncheck.com"},{"url":"https://github.com/immich-app/immich/pull/29883","label":"disclosure@vulncheck.com"},{"url":"https://github.com/immich-app/immich/releases/tag/v3.0.3","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/immich-shared-album-editor-ownership-takeover-via-updateuser","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-15T18:13:13.810826Z"},"epss":0.00456,"epssPercentile":0.38771,"ingestedAt":"2026-09-17T18:25:15.977Z","slug":"CVE-2026-59258","body":"## Overview\n\nimmich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":45.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}