Skip to content
OpenAdvisories

Vendor

immich-app

16 known vulnerabilities.

Products

immich 16
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.8
    CVE-2026-77439

    Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints

    Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demot…

    immich-app immich
  • High 7.7
    CVE-2026-105764

    Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

    Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that by…

    immich-app immich
  • High 8.3
    CVE-2026-59258

    immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

    immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to…

    immich-app immich
  • High 7.3
    CVE-2026-35455 Public exploit

    immich has Stored XSS via OCR Text in 360° Panorama Viewer

    immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who vie…

    immich-app immich
  • High 7.2
    CVE-2026-23896

    immich API Key Privilege Escalation vulnerability

    immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to th…

    immich-app immich
  • High 7.3
    CVE-2025-43856

    immich allows account hijacking through oauth2

    immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, because the state parameter is not being checked. The oauth2 state parameter is similar to a csrf token, …

    immich-app immich