immich vulnerabilities
CVEs whose affected-version data names the immich package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-59258High· 8.3PoCimmich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions
immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can dem…
▾ Midnightimmich-app · immichEPSS 0.46%via NVD
CVE-2026-25118High· 7.5immich is a high performance self-hosted photo and video management solution
immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication pr…
▾ Twilightfuto · immichEPSS 0.45%via NVD